[Wave 6] Add paginated audit log query and redacted export endpoint

Problem

Audit logs are written but there's no endpoint to query or export them for a compliance/incident review. Anyone needing an audit trail today has to query the database directly, with no redaction of sensitive fields.

Tasks

• Add an admin-guarded, paginated audit log query endpoint (filter by actor, action type, date range)
• Add a CSV/JSON export option for a filtered result set
• Redact sensitive fields (raw confession content, tokens, IPs beyond a configurable retention policy) in the exported output
• Add rate limiting to the export endpoint given it can be a heavier query

Acceptance Criteria

• Querying by date range + actor returns paginated results in under an agreed latency budget on seed data
• Exported output does not contain raw confession content or auth tokens
• Endpoint is inaccessible to non-admin roles (test covers this)

Labels

Backend, observability, security, help wanted, Stellar Wave