fix(06.2): WR-02 constrain format parameter to Literal[csv] to reject unsupported formats

backend/api/audit.py

@@ -27,7 +27,7 @@ import json
 import re
 import uuid
 from datetime import datetime
-from typing import Optional
+from typing import Literal, Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from fastapi.responses import StreamingResponse
@@ -313,7 +313,7 @@ async def export_audit_log(
     end: Optional[datetime] = Query(default=None),
     user_handle: Optional[str] = Query(default=None),
     event_type: Optional[str] = Query(default=None),
-    format: str = Query(default="csv"),  # noqa: A002
+    format: Literal["csv"] = Query(default="csv"),  # noqa: A002
     session: AsyncSession = Depends(get_db),
     _admin: User = Depends(get_current_admin),
 ) -> StreamingResponse: