Fix audit hanging: add auto_apply param + allow_write for tool access

Root cause: claude agent without --dangerously-skip-permissions
hangs on tool permission prompts when stdin=DEVNULL.

Fixes:
- run_audit() now passes allow_write=True so agent can use
  Read/Bash tools without interactive permission prompts
- Added auto_apply param: False for API (result only),
  CLI confirms with user then applies manually
- API explicitly passes auto_apply=False
- Tests for auto_apply=True/False behavior

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/api.py

@@ -399,7 +399,7 @@ def audit_project(project_id: str):
     if not p:
         conn.close()
         raise HTTPException(404, f"Project '{project_id}' not found")
-    result = run_audit(conn, project_id, noninteractive=True)
+    result = run_audit(conn, project_id, noninteractive=True, auto_apply=False)
     conn.close()
     return result