docs(web-ui): document the LOGS AUDIT sub-tab + /api/audit-log

The LOGS page gained a fourth sub-tab (AUDIT) surfacing the
agent-initiated privileged-action audit trail. Document the sub-tab
(lazy fetch, filterable table, outcome/denied badge colouring, the
latest-N-of-total clamp, 30s relative-time ticker) alongside BUILD /
AGENT / SYSTEM, add #audit to the hash-routing list, and add the
GET /api/audit-log endpoint to the API reference.

docs/web-ui/dashboard.md

@@ -510,8 +510,8 @@ root. All dashboard sub-pages include a `← Home` back-link for navigation.
 
 A dedicated log-viewer page (not a tab pane — a separate HTML page),
 reachable from the Logs tile on the H0M3 hub. Minimal chrome:
-a `← home` back link and a three-item sub-tab strip. Tab
-routing is hash-based (`#build`, `#agent`, `#system`); default is
+a `← home` back link and a four-item sub-tab strip. Tab
+routing is hash-based (`#build`, `#agent`, `#system`, `#audit`); default is
 `#build`.
 
 **BUILD sub-tab** — all-agents build log history. Fetches
@@ -555,6 +555,21 @@ chip ticks every 30 s. Available to the operator unconditionally (not
 capability-gated — the endpoint lives on the hive-c0re dashboard,
 behind the gateway).
 
+**AUDIT sub-tab** — operator-visible trail of agent-initiated
+privileged actions (e.g. infra-container restarts via `infra_admin`).
+Lazy-fetched on tab show (like SYSTEM) from `GET /api/audit-log`, which
+returns `{ entries, total }` — `entries` newest-first, server-clamped to
+the latest 500; `total` drives a "latest 500 of N" count so the clamp is
+never silent. Rendered as a filterable table (when / agent / action /
+target / outcome / detail); the filter box is a client-side substring
+match over the cached rows. The outcome badge colours `ok` green and
+`err` red, with an `err` whose `detail` starts `denied:` (a capability
+refusal) shown amber and labelled `denied` so it reads apart from an
+execution failure. `ts_unix` is unix seconds; a 30 s ticker keeps the
+relative "ago" column honest while the tab is in view. The backing
+`audit_log` store records every privileged-action attempt (ok / err /
+denied); a live-append off `/dashboard/stream` is a planned follow-up.
+
 ## Container row
 
 A full-height **square agent icon** (5em, capped) on the left. The
@@ -892,6 +907,12 @@ that's a browser-level decision, not ours.
   404 when the row is missing (vacuum-reaped or stale id).
 - `GET /api/journal/{name}?unit=&lines=` — journalctl viewer for
   a managed container; rendered in the side panel.
+- `GET /api/audit-log` — agent-initiated privileged-action audit
+  trail. Returns `{ entries, total }`: `entries` is a `Vec<AuditEntry>`
+  (`id`, `ts_unix` in seconds, `agent`, `action`, `target`, `outcome`
+  `"ok"`/`"err"`, `detail` nullable), newest first, server-clamped to
+  500; `total` is the full row count for a "latest 500 of N" header.
+  Backs the LOGS page AUDIT sub-tab.
 - `GET /api/approval-diff/{id}?base=applied|approved|previous` —
   on-demand unified diff for an `ApplyCommit` approval against
   the chosen base (running tree / last approved proposal /