Add SSH Structured Logging (Phase 1-5): ssh_audit_log.rs module with JSON tracing

Features:
- SshAuditLog: Structured audit logging using tracing crate
- 16 audit event types (connection/auth/command/file/port_forward)
- JSON output format via tracing-subscriber json layer
- 10 unit tests for all audit events

Files:
- markbase-core/src/ssh_server/ssh_audit_log.rs (289 lines)
- markbase-core/Cargo.toml (tracing + json layer)
- markbase-core/src/ssh_server/mod.rs (export module)

Tests: 298 passed (+10)

markbase-core/Cargo.toml

@@ -76,7 +76,8 @@ smb2 = { path = "../vendor/smb2" }  # Pure-Rust SMB2/3 client library with pipel
 # === SMB/CIFS Server (Phase 2) — optional (vendored) ===
 smb-server = { path = "../vendor/smb-server", optional = true, default-features = false }
 async-trait = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
 [features]
 default = []                          # 默认不启用可选格式