feat(audit-log): add configurable retention, export, Auditor role, and enhanced filtering (#258)

- Configurable retention: audit_retention_days setting (1-365 days, default 90)
  replaces hardcoded 90-day retention, exposed in Settings > Data Retention
- Export: one-click CSV/JSON export of filtered audit data via new
  GET /api/audit-log/export endpoint (capped at 10,000 entries)
- Auditor role: read-only role with system:audit permission for viewing
  and exporting audit logs without admin privileges (Admiral tier)
- Enhanced filtering: full-text search across summaries/paths/usernames,
  date range picker, and expandable row details showing request path,
  IP address, node ID, and entry ID

backend/src/services/MonitorService.ts

@@ -304,7 +304,8 @@ export class MonitorService {
             db.cleanupOldMetrics(isNaN(retentionHours) ? 24 : retentionHours);
             const retentionDays = parseInt(settings['log_retention_days'] || '30', 10);
             db.cleanupOldNotifications(isNaN(retentionDays) ? 30 : retentionDays);
-            db.cleanupOldAuditLogs(90);
+            const auditRetentionDays = parseInt(settings['audit_retention_days'] || '90', 10);
+            db.cleanupOldAuditLogs(isNaN(auditRetentionDays) ? 90 : auditRetentionDays);
         } catch (e) {
             console.error('MonitorService: failed to cleanup old data', e);
         }