docs: sprint 2 surface in docs/api.md + D-015/D-016/D-017 + changelog
- `docs/api.md` extended with the sprint-2 surface: pagination envelope
conventions, engagement members (GET/POST/DELETE), users (GET paginated
with `?type=`, POST, PATCH, DELETE-soft), audit log viewer with its
five filters. Anti-enumeration semantics (404 on foreign members) made
explicit. Drive-by fix: `/engagements<eid>` → `/engagements/<eid>`.
- `tasks/spec-decisions.md` logs the three sprint-2 decisions verbatim:
- **D-015** USER_MANAGE permission (wording from spec-analyst).
- **D-016** pagination envelope shape (`{items, total, page, page_size}`).
- **D-017** `engagement_member.role` stays a free-form label.
- `CHANGELOG.md` summarises the sprint with hashes / behaviours / decisions.
76f8443ac2