feat(audit-log): split changes from data access, add resource/action/lookup filters - #2422

🟢 Confidence 10/10 · safe to merge. Kind SQL, filter parsing, lookup refusal and the custom-range round-trip are pinned by tests; only the browser-level interplay of the new selects is unexercised.
_{no findings · tests covered · risk medium}

Splits the audit log into Changes / Data access / All and adds resource-type, action, affected-user, resource, request and lookup filters, plus a working custom range. The server keeps all as the API default, so no existing client changes behavior.

• GET /v2/audit_log gained kind=changes|access|all, defaulting to all
• AuditLogService.list pushes the access-action exclusion into the query, keeping denied reads
• The tab opens on Changes, with resource/action/affected filters and an ID lookup
• Custom range… opens the shared calendar and writes UTC instants into the URL

_{9833c48 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}