Add compliance audit log

Immutable audit_log table in the scanner DB records every significant
admin action (profile save/delete, token create/revoke, PIN changes,
source add/update/delete, scheduler job changes, scan start/stop, SMTP
save, dispositions, item delete/redact). GET /api/audit_log exposes
entries newest-first. New Audit Log tab in the Settings modal renders
the table on demand. Settings modal widened 540→640 px and tab labels
set to white-space:nowrap so the six-tab row fits on one line.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routes/app_routes.py

@@ -72,6 +72,18 @@ def get_lang_json():
     return jsonify(state.LANG)
 
 
+@bp.route("/api/audit_log")
+def audit_log_list():
+    """Return recent compliance audit log entries."""
+    try:
+        from gdpr_db import get_db as _get_db
+        limit  = min(int(request.args.get("limit", 200)), 1000)
+        action = request.args.get("action") or None
+        return jsonify(_get_db().get_audit_log(limit=limit, action=action))
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+
 @bp.route("/manual")
 def manual():
     """Serve the user manual as a styled, printable HTML page.