feat(dashboard): AUD1T — privileged-actions audit trail as a LOGS sub-tab

Adds an AUDIT sub-tab to /logs.html (alongside BUILD / AGENT / SYSTEM),
consuming GET /api/audit-log ({ entries, total }). A read-only filterable
table: when / agent / action / target / outcome / detail, newest-first,
with a 'latest 500 of N' header from total and a client-side substring
filter. Outcome badges colour ok green / err red, with an err whose detail
starts 'denied:' rendered amber + labelled 'denied' (capability refusal
reads distinct from an execution failure). Lazy-fetched on tab show (like
SYSTEM); a 30s ticker keeps the relative timestamps honest.

The audit_log store + endpoint landed in the prior audit-log backend work;
this is the operator-visible surface for it. Resolves #1647.

frontend/packages/dashboard/src/logs.html

@@ -30,6 +30,10 @@
          aria-controls="logs-pane-system" data-tab="system">
         <span class="logs-tab-label">SYSTEM</span>
       </a>
+      <a class="hive-tab" id="logs-tab-audit" href="#audit" role="tab"
+         aria-controls="logs-pane-audit" data-tab="audit">
+        <span class="logs-tab-label">AUDIT</span>
+      </a>
     </nav>
   </header>
 
@@ -78,6 +82,21 @@
       <pre id="system-output" class="journal-output">loading…</pre>
     </section>
 
+    <!-- AUDIT: operator-visible trail of agent-initiated privileged
+         actions (infra-container restarts, etc.). Filterable table backed
+         by GET /api/audit-log ({ entries, total }), newest first, server
+         clamped to the latest 500. -->
+    <section class="logs-pane" id="logs-pane-audit" data-tab-pane="audit"
+             role="tabpanel" aria-labelledby="logs-tab-audit">
+      <div class="logs-toolbar">
+        <input type="text" id="audit-filter" class="audit-filter"
+               placeholder="filter agent / action / target / detail…" autocomplete="off">
+        <button type="button" class="btn btn-restart" id="audit-refresh">↻ refresh</button>
+        <span id="audit-count" class="meta"></span>
+      </div>
+      <div id="audit-list"><p class="meta">loading…</p></div>
+    </section>
+
   </main>
 
   <script type="module" src="/static/logs.js" defer></script>