M1: implement operational core

Demo auth, seed import/reset, dashboard, vehicle/booking list+detail, audit trail. Backend: 19 tests passing, ruff clean. Frontend: React Router shell, typed API client, responsive pages. Verified end-to-end via curl and browser.

backend/tests/test_audit.py

@@ -0,0 +1,11 @@
+def test_demo_login_is_audited(ops_client):
+    response = ops_client.get("/api/v1/audit", params={"action": "demo_login"})
+    assert response.status_code == 200
+    events = response.json()
+    assert len(events) >= 1
+    assert events[0]["action"] == "demo_login"
+
+
+def test_audit_requires_authentication(client):
+    response = client.get("/api/v1/audit")
+    assert response.status_code == 401