feat: enforce api permissions

backend/apps/audit/api.py

@@ -3,6 +3,7 @@ from typing import Any
 
 from ninja import Router, Schema
 
+from apps.accounts.api import require_permission
 from apps.audit.models import OperationAuditLog
 
 router = Router(tags=["audit"])
@@ -23,4 +24,5 @@ class OperationAuditLogOut(Schema):
 
 @router.get("/operation-logs", response=list[OperationAuditLogOut])
 def list_operation_logs(request):
+    require_permission(request, "system.audit.view")
     return OperationAuditLog.objects.all()[:100]