Query audit logs from Loki.

Usage

AuditTrail.Reader.get_logs(%{
  action:     "item:approved",
  actor_id:   "user-uuid",
  status:     "success",
  resource:   "payment",
  operation:  "update",
  start_date: "2026-06-01",
  end_date:   "2026-06-12",
  search:     "item_id",
  limit:      100
})

resource and operation are optional payload fields (only present on logs where the caller opted into resource/CRUD tagging). Filtering on them is a JSON field match on the log line, not a stream label, to avoid adding cardinality.