feat(audit): Phase 5 - Integrate audit logging with channels

Add audit logging to channel operations:

- Log rejected messages (allowlist filtering) in base.go
- Log send failures in manager.go
- Include message ID and channel context for tracing

This provides visibility into:
- Security events (rejected messages)
- Delivery failures
- Channel-specific issues

pkg/channels/base.go

@@ -10,6 +10,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/sipeed/picoclaw/pkg/audit"
 	"github.com/sipeed/picoclaw/pkg/bus"
 	"github.com/sipeed/picoclaw/pkg/config"
 	"github.com/sipeed/picoclaw/pkg/identity"
@@ -240,10 +241,14 @@ func (c *BaseChannel) HandleMessage(
 	}
 	if sender.CanonicalID != "" || sender.PlatformID != "" {
 		if !c.IsAllowedSender(sender) {
+			// Audit log rejected message
+			audit.LogMessage(ctx, "inbound_rejected", "text", content, messageID)
 			return
 		}
 	} else {
 		if !c.IsAllowed(senderID) {
+			// Audit log rejected message
+			audit.LogMessage(ctx, "inbound_rejected", "text", content, messageID)
 			return
 		}
 	}

pkg/channels/manager.go

@@ -17,6 +17,7 @@ import (
 
 	"golang.org/x/time/rate"
 
+	"github.com/sipeed/picoclaw/pkg/audit"
 	"github.com/sipeed/picoclaw/pkg/bus"
 	"github.com/sipeed/picoclaw/pkg/config"
 	"github.com/sipeed/picoclaw/pkg/constants"
@@ -537,6 +538,9 @@ func (m *Manager) sendWithRetry(ctx context.Context, name string, w *channelWork
 		"error":   lastErr.Error(),
 		"retries": maxRetries,
 	})
+	
+	// Audit log the send failure
+	audit.LogError(ctx, "send_failed", fmt.Sprintf("channel=%s chat_id=%s: %v", name, msg.ChatID, lastErr), false)
 }
 
 func (m *Manager) dispatchOutbound(ctx context.Context) {