audit-log: expose total count in /api/audit-log response

Per iris's dashboard-side ask: return { entries, total } instead of a
bare array so the UI can show 'latest 500 of N' rather than silently
capping at the clamp. Adds AuditLog::count_total().

hive-c0re/src/audit_log.rs

@@ -168,6 +168,14 @@ impl AuditLog {
         Ok(out)
     }
 
+    /// Total row count, regardless of the `list_recent` clamp. Lets the
+    /// dashboard show "latest N of TOTAL" instead of silently capping.
+    pub fn count_total(&self) -> Result<i64> {
+        let conn = self.conn.lock().unwrap();
+        let n: i64 = conn.query_row("SELECT COUNT(*) FROM audit_log", [], |r| r.get(0))?;
+        Ok(n)
+    }
+
     /// Drop rows older than the retention window. Returns the number of
     /// rows deleted. Called from the hourly vacuum loop.
     pub fn vacuum(&self) -> Result<u64> {
@@ -255,6 +263,7 @@ mod tests {
         assert!(rows[1].detail.is_none());
         assert_eq!(rows[0].agent, "atlas");
         assert_eq!(rows[0].action, "restart_infra");
+        assert_eq!(db.count_total().expect("count"), 2);
     }
 
     #[test]