364447d0bc
- Create backend/api/audit.py: GET /api/admin/audit-log (paginated, filtered) and GET /api/admin/audit-log/export (streaming CSV) - Both endpoints protected by Depends(get_current_admin) — regular users → 403 - _audit_to_dict() whitelist explicitly excludes filename, extracted_text, password_hash, credentials_enc (T-04-06-02, D-15) - CSV export uses same helper as JSON viewer; Content-Disposition: attachment - Register audit_router in backend/main.py