feat(audit-log): day headings, a red edge on refusals, quieter reads - #2424

🟢 Confidence 10/10 · safe to merge. Contained UI change; the new heading and day-label behaviour is pinned by a scene test plus the moved DST and zone-midnight cases.
_{no findings · tests covered · risk low}

Groups audit log rows under day headings, gives denied rows a red left edge, mutes allowed reads in the All view only, and shares dayKey/dayLabel from page/kit. Safe to merge.

• withDayHeadings renders a Today/Yesterday/date heading wherever the viewer's local day changes
• dayKey and dayLabel move to page/kit/day-label, used by the users detail too
• isQuietAccess mutes allowed read, tool, SQL and API actions, gated on the All view
• Denied rows carry a border-l-severity-error edge; the Source column shows from @xl

_{33f2691 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}