feat: audit logging, secrets at rest, and legacy cleanup (#205)

* feat: audit logging, secrets at rest, and legacy cleanup

- Add Team Pro audit log: records all mutating API actions with user
  attribution, searchable timeline UI with filtering and pagination
- Add AES-256-GCM encryption at rest for node API tokens via CryptoService
- Drop 9 legacy SSH/TLS columns from nodes table (dead since v0.7)
- Remove orphaned MaintenanceModal.tsx (dead code, never imported)
- Add requireTeamPro backend guard for team-tier features
- Add audit log cleanup (90-day retention) to MonitorService
- Add docs page and navigation entry for audit log feature

* fix: remove unused AUTH_TAG_LENGTH constant from CryptoService

docs/docs.json

@@ -95,6 +95,7 @@
           "features/rbac",
           "features/atomic-deployments",
           "features/fleet-backups",
+          "features/audit-log",
           "features/licensing"
         ]
       },

docs/features/audit-log.mdx

@@ -0,0 +1,58 @@
+---
+title: Audit Log
+description: Track all mutating actions across your Sencho instance with a searchable audit trail for team accountability.
+---
+
+<Note>
+  The Audit Log requires a Sencho **Team Pro** license. Personal Pro and Community Edition do not include this feature.
+</Note>
+
+Sencho Team Pro records every mutating action (deploy, stop, delete, settings changes, user management) with full attribution. The audit log answers the question every team eventually asks: **"Who changed what, and when?"**
+
+## What gets logged
+
+Every `POST`, `PUT`, `DELETE`, and `PATCH` request to the Sencho API is automatically recorded with:
+
+| Field | Description |
+|-------|-------------|
+| **Timestamp** | When the action occurred |
+| **User** | The authenticated username that performed the action |
+| **Method** | HTTP method (`POST`, `PUT`, `DELETE`, `PATCH`) |
+| **Action** | Human-readable summary (e.g., "Deployed stack: nginx-proxy") |
+| **Status** | HTTP response status code |
+| **Node** | Which node the action targeted |
+
+### Example actions tracked
+
+- Stack lifecycle: deploy, stop, start, restart, pull, delete
+- Stack creation and file edits
+- Node management: add, update, delete
+- User management: create, delete, role changes
+- Settings changes
+- System prune operations
+- License activation/deactivation
+- Webhook and notification agent configuration
+- Fleet backup creation, restoration, and deletion
+
+## Viewing the audit log
+
+Navigate to the **Audit** tab in the sidebar (visible to Team Pro admins only).
+
+<Frame>
+  <img src="/images/audit-log.png" alt="Audit Log view showing a timeline of actions" />
+</Frame>
+
+### Filtering
+
+- **Username filter** — Search for actions by a specific user
+- **Method filter** — Filter by HTTP method (POST, PUT, DELETE, PATCH)
+
+Pagination is built in for navigating large audit histories.
+
+## Data retention
+
+Audit log entries are automatically cleaned up after **90 days**. This runs as part of Sencho's periodic maintenance cycle alongside metrics and notification cleanup.
+
+## Security at rest
+
+As of this release, sensitive database values (such as remote node API tokens) are encrypted at rest using AES-256-GCM. The encryption key is stored as a separate file outside the SQLite database, ensuring that database file exposure alone does not compromise secrets.

docs/features/overview.mdx

@@ -67,6 +67,10 @@ Pro users get automatic backup and rollback on every deployment. Before applying
 
 Create point-in-time snapshots of every compose file and environment file across all nodes. Snapshots are stored centrally and can be browsed by node and stack. Restore individual stacks from any snapshot with optional one-click redeploy - even to remote nodes. [Learn more →](/features/fleet-backups)
 
+## Audit log
+
+Track every mutating action across your Sencho instance with a searchable audit trail. See who deployed, stopped, deleted, or changed settings — with timestamps, user attribution, and node context. Team Pro only. [Learn more →](/features/audit-log)
+
 ## Licensing & billing
 
 Sencho is free for personal use with the Community tier. Pro unlocks RBAC, webhooks, fleet backups, atomic deployments, and advanced fleet features. Manage your license, view subscription details, and access the billing portal from Settings. [Learn more →](/features/licensing)