Route gateway audit logs to Loki

Post http-log to /catalog instead of /logs. Fluent Bit's http input derives the
record tag from the request URI, so the path is what identifies this domain
in the collector and becomes the Loki label domain=catalog.

The collector keeps writing every domain to the on-disk audit trail as
well, so this is reversible by restoring the previous path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/flux-kustomization.yaml

@@ -25,7 +25,9 @@ spec:
       BACKEND_AUDIENCE: '["classic-models-api"]'
       BACKEND_SCOPES: '[]'
       API_RATE_LIMIT_MINUTE: "60"
-      AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs
+      # The URI path is the collector's routing key: Fluent Bit tags the
+      # record `catalog` and turns that into the Loki label domain=catalog.
+      AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/catalog
       REST_HOSTNAME: catalog-dev.sttlab.local
       MCP_AUDIENCE: '["mcp-catalog"]'
       TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker