Auditor’s office demands $1.9m from private prison operator who ‘put staff and inmates at risk’