Returns combined statistics for crypto, admin, and auth operations across all tenants (or filtered by tenant list). Includes KPI fields for the Global Audit Log header: todayEvents, securityAlerts, failedOps, uniqueActors, and per-subsystem breakdowns. Auth events (including pre-authentication null-tenant rows) are included in totalEvents, securityAlerts, and todayEvents when tenantIds is omitted. Updated to include auth subsystem: 2026-04-12.