#2990 Serve audit: sink filter config in serve.yaml is never validated

Problem

audit.sinks entries in .swamp/serve.yaml accept a filter block (categories, tier, outcomes). validateAuditConfig in src/serve/serve_config.ts never checks it, and parseSinkFilter in src/domain/serve_audit/sink_filter.ts only casts the raw value. A typo such as tier: managment or categories: auth (a string, not a list) is accepted silently, and the sink then filters incorrectly or receives nothing.

Expected

Startup validation rejects (or at least warns about) an unknown tier, a non-array categories/outcomes value, unknown category names, and unknown keys under filter, naming the sink entry index.

Note: making this a hard error could stop serve configs that start today; consider warn-first.

Found while triaging swamp-club#2112 (extension audit sinks).