v1.6.28 — Scheduled report-only jobs, compliance audit log, and documentation update

- Scheduled jobs can now run in report-only mode (skip scan, email latest DB results)
- Compliance audit log records all significant admin actions in an immutable DB table
- VERSION bumped to 1.6.28; CHANGELOG [Unreleased] sealed as [1.6.28] — 2026-05-28
- Both manuals updated: CPR-only mode, OCR language, file redaction, related documents,
  date-range token scoping, report-only jobs, audit log tab, two new FAQ entries
- TODO.md updated with all completed tasks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lang/en.json

@@ -753,6 +753,8 @@
   "m365_sched_after_scan": "After scan",
   "m365_sched_auto_email": "Email report automatically",
   "m365_sched_auto_retention": "Enforce retention policy",
+  "m365_sched_report_only": "Report only",
+  "m365_sched_report_only_hint": "Email the latest scan results without running a new scan. Requires scan results in the database.",
   "m365_sched_status": "Status",
   "m365_sched_run_now": "▶ Run now",
   "m365_sched_add": "+ Add scheduled scan",