api: `audit-log` endpoint does not work with bot tokens

Looking through how things are handled, it seems the audit-log endpoint uses an auth mode that explicitly disallows bot users.

I wonder if there's any reason for this, given that we can granuarly set permissions to grant a bot access to it