feat(dashboard): AUD1T — privileged-actions audit trail as a LOGS sub-tab

Adds an AUDIT sub-tab to /logs.html (alongside BUILD / AGENT / SYSTEM),
consuming GET /api/audit-log ({ entries, total }). A read-only filterable
table: when / agent / action / target / outcome / detail, newest-first,
with a 'latest 500 of N' header from total and a client-side substring
filter. Outcome badges colour ok green / err red, with an err whose detail
starts 'denied:' rendered amber + labelled 'denied' (capability refusal
reads distinct from an execution failure). Lazy-fetched on tab show (like
SYSTEM); a 30s ticker keeps the relative timestamps honest.

The audit_log store + endpoint landed in the prior audit-log backend work;
this is the operator-visible surface for it. Resolves #1647.

frontend/packages/dashboard/src/index.html

@@ -49,7 +49,7 @@
           <span class="home-tile-icon" aria-hidden="true">📜</span>
           <span class="home-tile-label">Logs</span>
         </span>
-        <span class="home-tile-desc">build · agent · system logs</span>
+        <span class="home-tile-desc">build · agent · system logs · privileged-action audit</span>
       </a>
 
       <a class="home-tile" href="/stats.html">