feat(audit): filterable audit log page under Settings

The audit trail existed only as a summary card — no table, no filters.
The list endpoint was also self-scoped and never returned user_email
(the field existed on the struct but was never selected).

Backend: GET /audit-logs now joins users for email and accepts
user_id / actor (email ILIKE) / since (RFC3339) filters alongside the
existing resource/action/page/limit. Widening past self-scope matches
the platform's no-roles trust model — every authed user can already
create users. RLS on audit_logs is dormant (superuser connection,
app.current_user_id never set).

Frontend: /settings/audit-logs page with deferred filter inputs, time
range select, paginated table (time, actor, resource, action, id, IP,
details), linked from a Settings card. Spec updated and types
regenerated.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP.md

@@ -267,8 +267,13 @@ All of these have working APIs and no UI. Cheapest feature wins in the repo.
 - [ ] **Preview environments** (`/preview-environments/*`): per-PR/per-branch
       preview creation, promote-to-production action, expiry + cleanup job.
       Decide first whether this stays Phase 2 or moves with env support (§2.4).
-- [ ] **Audit logs**: real UI page under Settings (filterable by resource,
-      actor, time); already queried — needs a table, not just a list call.
+- [x] **Audit logs**: real page at `/settings/audit-logs` (linked from the
+      Settings page) — filterable table by resource, action, actor (email),
+      and time range, with pagination. Backend widened accordingly: the list
+      endpoint was self-scoped and dropped `user_email`; it now joins `users`
+      and accepts `user_id`/`actor`/`since` filters. Widening is consistent
+      with the platform's no-roles trust model (every authed user can already
+      create users).
 - [ ] **Agents/nodes**: onboarding flow — generate token, show install command
       for `cmd/agent`, node cards with heartbeat status + telemetry on Usage
       page.