Consumers now depend on IAuditService instead of the concrete class,
so tests mock the interface (Mock<IAuditService>()) rather than
subclassing AuditService via virtual methods.
WebhookEvent, FeatureStateResult, ProjectPermissionRequirement, AuditLog,
Tag, and FeatureUsageDaily are plain data holders with no behavior, so
switch them to records. EF-mapped entities with identity semantics
(User, Organization, Project, Feature, Segment, etc.) stay classes,
since record value-equality and deep ToString fight EF's change tracker.
Also restore `virtual` on AuditService.RecordAsync/LogAsync, which had
been dropped and broke Mock<AuditService>-based test setups.
## Summary
- Extract `IMicCheckDbContext` and mock DB access with Moq instead of the EF InMemory provider, per CLAUDE.md testing guidelines.
- Rewrite HTTP-pipeline tests to exercise controllers/auth handlers directly instead of `WebApplicationFactory`.
- Remove tuple return types across the API in favor of named records (`PagedResult<T>`, `ProfileUpdateResult`, `ApiKeyCreationResult`).
## Test plan
- [x] `dotnet build` (full solution)
- [x] `dotnet test tests/api/MicCheck.Api.Tests.Unit` — 187/187 pass
- [x] `dotnet test tests/api/MicCheck.Api.Tests.Integration` — 8/8 pass (live API + Postgres via Aspire)
- [x] Verified Aspire AppHost/dashboard starts and API responds
Reviewed-on: #4
