test(audit-log): assert PAID_REQUIRED code on Community-blocked stats and export (#1417)

The /stats and /export routes run the paid-license guard before the
permission guard, so a Community admin's rejection comes from the paid
gate. The existing tests only checked the 403 status, which a permission
gate would also produce, so they did not prove which gate fired.

Assert res.body.code === 'PAID_REQUIRED' on both so each test pins the
rejection to the paid gate, matching the assertion already used in the
secrets suite.

backend/src/__tests__/audit-log.test.ts

@@ -655,6 +655,7 @@ describe('GET /api/audit-log/stats', () => {
       .get('/api/audit-log/stats')
       .set('Authorization', `Bearer ${adminToken()}`);
     expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
   });
 
   it('returns the four-tile stat structure for admin', async () => {
@@ -682,6 +683,7 @@ describe('GET /api/audit-log/export', () => {
       .get('/api/audit-log/export?format=json')
       .set('Authorization', `Bearer ${adminToken()}`);
     expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
   });
 
   it('exports JSON with correct Content-Type', async () => {