Tool creation now shows up in the events feed

GET /api/v1/tools/{id}/events previously skipped the moment of creation — the feed only contained CHECK_OUT / CHECK_IN / ASSIGNMENT / FAILURE_REPORT / AUDIT (stock + PM) entries. Now createTool() emits an AUDIT row with a `tool_created: name=... category=... consumable=true` structured prefix so consumers paginating the feed see the full lifecycle from row zero. Best-effort emission (the create still succeeds if the event log write rejects). 6 new contract tests cover the prefix shape, consumable flag, actor=null bulk-import path, validation-failure no-emit, and best-effort failure recovery.