Audit log screen: download an export and look up an item's history #2458

Part of #2424 (F-AUD). Third slice: the first screen on the log. A signed-in administrator downloads the full log, a date range of it or one item's history as JSON or CSV, through the exporter from #2446, and looks up one item's history on screen. Every export is itself recorded in the log. No API or MCP exposure.

Scope

• Core: IAuditExporter.ExportAsync appends audit.exported in its own unit of work and commits it before anything is written, so every way of exporting is recorded (AUD-01). When the selection is one item's history, the event names that item as its subject. An invalid query or format appends nothing. The event records who exported, when, and which item; the window and the format have no AUD-01 field to go in. Viewing history on screen is a read and is not recorded.
• Admin: /audit, rendered on the server without interactivity, like the account pages (a stateless page in ADR-0006 terms). It has two parts, plus an "Audit log" link in the main layout. Strings go through IStringLocalizer and the layout uses logical utilities only.
  • Export form: from and to as UTC dates, both included, either optional; an optional item type and id; Download JSON and Download CSV.
  • History lookup: an item's type and id, listing its events oldest first with every AUD-01 field. It shows at most 200 events and points to the export for the rest.
• Admin: AuditExportForm maps the posted fields to an AuditQuery and a format. It reports an unreadable date, a malformed item id and an unknown format as result errors.
• Host: POST /audit/export requires a signed-in user and a valid anti-forgery token, like every form. It streams the export with Content-Disposition: attachment and Cache-Control: no-store. A rejected selection goes back to /audit with each problem next to its field and the values kept. The endpoint only maps the form and calls the exporter; it exists because a page cannot answer with a file.
• Components (refs Admin shell and component set #2434): Badge, to tell user and agent initiators apart in the history, with bUnit tests. The rest of the page uses Input, FormField, Button and Card as they are.

Out of scope

• API and MCP exposure of the export.
• A browsable, filterable audit log with paging (ADM-01, M2). The lookup shows one item's history.
• Recording an export's window and format: that needs a details field on the audit event, which is a model change.
• The report of items published without human review (DSC-04), provenance summary (AUD-02), prompt store (AUD-04), security events (SEC-08) and the logged retention purge: later slices.

Acceptance

• Anonymous: GET /audit and POST /audit/export lead to sign-in and record nothing.
• Signed in: a JSON and a CSV download return the selected events as an attachment with the right content type and no-store: what the reader returns for the selection, the export's own event included. Each download appends one audit.exported event naming the user, and an item's export names the item.
• A rejected export (end before start, an item type without an id, a malformed id) returns to the page with each problem next to its field and the values kept, and records nothing. A post without a valid anti-forgery token gets 400 and records nothing.
• The history lookup shows an item's events oldest first with the initiator's kind and name, agent credential, model, prompt hash, sources, change set and previous version. It says when nothing matches and when the id is malformed.
• Unit tests for the form mapping and for the exporter committing its event before it writes; bUnit tests for Badge.
• Pages and downloads keep the content security policy from Add sign-in, first-run setup and web hardening #2450, and the page has no inline script or style.