feat(audit-log): add configurable retention, export, Auditor role, and enhanced filtering (#258)

- Configurable retention: audit_retention_days setting (1-365 days, default 90)
  replaces hardcoded 90-day retention, exposed in Settings > Data Retention
- Export: one-click CSV/JSON export of filtered audit data via new
  GET /api/audit-log/export endpoint (capped at 10,000 entries)
- Auditor role: read-only role with system:audit permission for viewing
  and exporting audit logs without admin privileges (Admiral tier)
- Enhanced filtering: full-text search across summaries/paths/usernames,
  date range picker, and expandable row details showing request path,
  IP address, node ID, and entry ID

docs/features/audit-log.mdx

@@ -1,6 +1,6 @@
 ---
 title: Audit Log
-description: Track all mutating actions across your Sencho instance with a searchable audit trail for team accountability.
+description: Track all mutating actions across your Sencho instance with a searchable, exportable audit trail for team accountability.
 ---
 
 <Note>
@@ -21,6 +21,8 @@ Every `POST`, `PUT`, `DELETE`, and `PATCH` request to the Sencho API is automati
 | **Action** | Human-readable summary (e.g., "Deployed stack: nginx-proxy") |
 | **Status** | HTTP response status code |
 | **Node** | Which node the action targeted |
+| **Request Path** | Full API path (visible in expanded detail view) |
+| **IP Address** | Client IP address (visible in expanded detail view) |
 
 ### Example actions tracked
 
@@ -33,25 +35,59 @@ Every `POST`, `PUT`, `DELETE`, and `PATCH` request to the Sencho API is automati
 - License activation/deactivation
 - Webhook and notification agent configuration
 - Fleet backup creation, restoration, and deletion
+- Scheduled task management
+- Registry credential management
 
 ## Viewing the audit log
 
-Navigate to the **Audit** tab in the sidebar (visible to Admiral admins only).
+Navigate to the **Audit** tab in the sidebar. This tab is visible to users with the **Admin** or **Auditor** role on an Admiral license.
 
 <Frame>
-  <img src="/images/audit-log.png" alt="Audit Log view showing a timeline of actions" />
+  <img src="/images/audit-log/audit-log-overview.png" alt="Audit Log view showing a timeline of actions with search, filters, and export" />
 </Frame>
 
-### Filtering
+Click any row to expand it and see full request details including the API path, IP address, node ID, and entry ID.
 
-- **Username filter** - Search for actions by a specific user
-- **Method filter** - Filter by HTTP method (POST, PUT, DELETE, PATCH)
+## Filtering & search
 
-Pagination is built in for navigating large audit histories.
+The audit log provides several ways to find specific entries:
 
-## Data retention
+- **Full-text search** — Search across action summaries, API paths, and usernames
+- **Method filter** — Filter by HTTP method (POST, PUT, DELETE, PATCH)
+- **Date range** — Set a start and/or end date to narrow results to a specific time window
 
-Audit log entries are automatically cleaned up after **90 days**. This runs as part of Sencho's periodic maintenance cycle alongside metrics and notification cleanup.
+All filters work together and are applied server-side with pagination.
+
+## Export
+
+Export the currently filtered audit log dataset as **CSV** or **JSON** using the **Export** dropdown in the header. The export respects all active filters — so you can narrow down to a date range or specific user before exporting.
+
+Exports are capped at 10,000 entries per download.
+
+## Auditor role
+
+The **Auditor** role provides read-only access to the audit log without granting any administrative privileges. Auditors can:
+
+- View the full audit log
+- Search and filter entries
+- Export audit data as CSV or JSON
+- View stacks and nodes (read-only)
+
+Auditors **cannot** modify settings, manage users, deploy stacks, or perform any other administrative actions. This role is ideal for compliance officers, security reviewers, or team leads who need visibility into system activity without operational access.
+
+To create an Auditor user, go to **Settings → Users** and select the **Auditor** role when creating a new user.
+
+## Configurable data retention
+
+Audit log entries are automatically cleaned up based on your configured retention period. The default is **90 days**.
+
+To change the retention period:
+
+1. Go to **Settings → Developer → Data Retention**
+2. Set the **Audit Log Retention** value (1–365 days)
+3. Click **Save Developer Settings**
+
+Cleanup runs automatically as part of Sencho's periodic maintenance cycle.
 
 ## Security at rest