fix(06.2): audit log — add email column, remove @ prefix from handles

- Backend: add user_email to _build_filtered_query_with_handles (UserSubject join) and _audit_to_dict_with_handles; propagate through JSON viewer and CSV export including empty-result path
- Frontend: AuditLogTab adds Email column between User and Action Type; removes @ prefix from handle cell
- Test: update expected CSV header to include user_email

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_audit.py

@@ -181,7 +181,7 @@ async def test_audit_log_export_csv(async_client, admin_user, db_session):
     # Phase 6.2: CSV now includes user_handle and actor_handle columns (D-11, Pitfall 7)
     expected_header = (
         "id,event_type,user_id,actor_id,user_handle,actor_handle,"
-        "resource_id,ip_address,metadata_,created_at"
+        "user_email,resource_id,ip_address,metadata_,created_at"
     )
     assert expected_header in response.text, (
         f"CSV header line not found in response. "