A new Management > Compliance section, with an Audit log page over
inbuxa:AuditEvent (inbuxa-drafts/specs/audit-hold-lock.md, AU-9 to AU-11):
- newest first, 50 to a page, with who acted and how they signed in, what
happened, to what, and the outcome (done, refused, or unfinished when
the server stopped before a change finished);
- filters for words, a date range, what happened and the outcome;
- a record's detail: address, reason, details, and each setting's before
and after, with secrets shown only as changed;
- Export: CSV or JSON Lines of what the filters match, built by the
server, with an optional reason; the toast gives the file's SHA-256;
- Check for tampering: rechecks every node's chain and names any break;
- retention, shown in the header and editable (90 days or more).
Export needs sysAuditExport; retention and the tamper check are for
server administrators (sysAuditSettingsUpdate). The menu link shows for
whoever holds sysAuditGet. The list fetches again after the page's own
actions, since they are recorded too.
Tests: filter building, record normalizing and labels.
jcoffey-dev