feat(cert-export): typed audit-action constants + has_private_key + cipher detail (Phase 7)

Production hardening II Phase 7 — typify the cert-export audit
emission. The pre-Phase-7 audit log carried inline strings
("export_pem" / "export_pkcs12"); this commit adds typed
constants alongside via the split-emit pattern so operators get
both back-compat with existing log analysers AND a stable typed
grep target.

NEW internal/service/export_audit_actions.go:
  - AuditActionCertExportPEM = "cert_export_pem"
  - AuditActionCertExportPEMWithKey = "cert_export_pem_with_key"
    (reserved for future bundle that adds key-bearing export; not
    emitted in V2)
  - AuditActionCertExportPKCS12 = "cert_export_pkcs12"
  - AuditActionCertExportFailed = "cert_export_failed"
  - PKCS12CipherModernAES256 = "AES-256-CBC-PBE2-SHA256" pinned
    string for the cipher detail (drift catches a future go-pkcs12
    default change)

Detail enrichment on both emission sites:
  - has_private_key (bool, V2 always false — cert-only export is
    the only V2 path; key-bearing export deferred to future bundle)
  - actor_kind ("user")
  - cipher (PKCS12 only — pinned to PKCS12CipherModernAES256)

Split-emit pattern: each export emits BOTH the legacy bare action
code AND the typed constant. Mirrors est.go::processEnrollment which
emits both "est_simple_enroll" + "est_simple_enroll_success".
Existing audit-log analysers that match by exact string "export_pem"
keep working; new operator alerts can target the typed constant.

Pre-commit verification: go build ./... clean; go test -short
-count=1 green for service/.

internal/service/export.go

@@ -53,12 +53,24 @@ func (s *ExportService) ExportPEM(ctx context.Context, certID string) (*ExportPE
 	// Split PEM chain into leaf cert + chain
 	certPEM, chainPEM := splitPEMChain(version.PEMChain)
 
-	// Audit the export
+	// Audit the export — split-emit per Phase 7 split-emit pattern.
+	// Legacy bare code "export_pem" preserved for back-compat with
+	// existing audit-log analysers; typed AuditActionCertExportPEM
+	// emitted alongside as the new operator grep target. Mirrors
+	// est.go::processEnrollment's split-emit pattern.
 	if s.auditService != nil {
+		details := map[string]interface{}{
+			"serial":          version.SerialNumber,
+			"has_private_key": false, // V2: cert-only path
+			"actor_kind":      "user",
+		}
 		if auditErr := s.auditService.RecordEvent(ctx, "api", domain.ActorTypeUser,
-			"export_pem", "certificate", cert.ID,
-			map[string]interface{}{"serial": version.SerialNumber}); auditErr != nil {
-			slog.Error("failed to record audit event", "error", auditErr)
+			"export_pem", "certificate", cert.ID, details); auditErr != nil {
+			slog.Error("failed to record audit event (legacy)", "error", auditErr)
+		}
+		if auditErr := s.auditService.RecordEvent(ctx, "api", domain.ActorTypeUser,
+			AuditActionCertExportPEM, "certificate", cert.ID, details); auditErr != nil {
+			slog.Error("failed to record audit event (typed)", "error", auditErr)
 		}
 	}
 
@@ -108,12 +120,25 @@ func (s *ExportService) ExportPKCS12(ctx context.Context, certID string, passwor
 		return nil, fmt.Errorf("failed to encode PKCS#12: %w", err)
 	}
 
-	// Audit the export
+	// Audit the export — split-emit per Phase 7. Typed code
+	// AuditActionCertExportPKCS12 + cipher detail. The cipher value
+	// is pinned to PKCS12CipherModernAES256 so a future dependency
+	// upgrade that changes the encoder default surfaces in audit
+	// drift review.
 	if s.auditService != nil {
+		details := map[string]interface{}{
+			"serial":          version.SerialNumber,
+			"has_private_key": false, // V2: trust-store mode only
+			"cipher":          PKCS12CipherModernAES256,
+			"actor_kind":      "user",
+		}
 		if auditErr := s.auditService.RecordEvent(ctx, "api", domain.ActorTypeUser,
-			"export_pkcs12", "certificate", cert.ID,
-			map[string]interface{}{"serial": version.SerialNumber, "has_private_key": false}); auditErr != nil {
-			slog.Error("failed to record audit event", "error", auditErr)
+			"export_pkcs12", "certificate", cert.ID, details); auditErr != nil {
+			slog.Error("failed to record audit event (legacy)", "error", auditErr)
+		}
+		if auditErr := s.auditService.RecordEvent(ctx, "api", domain.ActorTypeUser,
+			AuditActionCertExportPKCS12, "certificate", cert.ID, details); auditErr != nil {
+			slog.Error("failed to record audit event (typed)", "error", auditErr)
 		}
 	}