feat: audit/change log — owner-visible record of who changed what

Add AuditManager (api/audit_manager.py): JSONL append-only log at
data/api/audit/audit.log with SHA-256 hash chain for tamper detection,
verify endpoint, size-based rotation, and automatic redaction of secret
fields before any entry is written. Supports structured query (actor,
action, date range) and CSV export.

Wire an @app.after_request hook in app.py that fires on every mutating
/api/* request: captures actor, role, remote IP, and maps the route +
method to a human-readable action via ROUTE_ACTION_MAP. Explicit audit
entries for password_change and password_reset are added in
auth_routes.py so those events record the actor without logging secret
values.

Expose an admin-only blueprint (api/routes/audit.py):
  GET /api/audit          — paginated query
  GET /api/audit/export   — CSV download
  GET /api/audit/verify   — hash-chain integrity check

Register AuditManager in managers.py and add api/audit to
config_manager.py critical_data_paths so it is included in backups and
restored with other persistent state.

Add Activity page (webui/src/pages/Activity.jsx, admin-only) reachable
from the nav in App.jsx. New auditAPI helper in api.js covers all three
endpoints.

Tests: test_audit_manager.py (unit: hash chain, redaction, rotation,
query, csv, verify) and test_audit_hook_routes.py (integration: hook
fires on mutating routes, skips safe methods, records actor/ip/action,
backup-inclusion assertion).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_config_backup_overhaul.py

@@ -58,6 +58,7 @@ class _BackupBase(unittest.TestCase):
         _write(d / 'api' / 'peer_service_credentials.json', '{}')
         _write(d / 'api' / 'cell_links.json', '{"link": 1}')
         _write(d / 'api' / 'ddns_token', 'tok123')
+        _write(d / 'api' / 'audit' / 'audit.log', '{"seq": 1, "action": "peer.create"}')
         _write(d / 'wireguard' / 'keys' / 'server_private.key', 'PRIV')
         _write(d / 'wireguard' / 'wg_confs' / 'wg0.conf', '[Interface]')
         _write(d / 'api' / 'wireguard' / 'keys' / 'private.key', 'P2')
@@ -92,6 +93,7 @@ class TestBackupInclude(_BackupBase):
             'data/api/peer_service_credentials.json',
             'data/api/cell_links.json',
             'data/api/ddns_token',
+            'data/api/audit/audit.log',
             'data/wireguard/keys/server_private.key',
             'data/wireguard/wg_confs/wg0.conf',
             'data/api/wireguard/keys/private.key',