Add compliance audit log

Immutable audit_log table in the scanner DB records every significant
admin action (profile save/delete, token create/revoke, PIN changes,
source add/update/delete, scheduler job changes, scan start/stop, SMTP
save, dispositions, item delete/redact). GET /api/audit_log exposes
entries newest-first. New Audit Log tab in the Settings modal renders
the table on demand. Settings modal widened 540→640 px and tab labels
set to white-space:nowrap so the six-tab row fits on one line.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routes/scan.py

@@ -19,6 +19,11 @@ from checkpoint import (
 bp = Blueprint("scan", __name__)
 _log = logging.getLogger(__name__)
 
+try:
+    from gdpr_db import log_audit_event as _audit
+except ImportError:
+    def _audit(*a, **kw): pass  # type: ignore[misc]
+
 
 def _maybe_send_auto_email():
     """Send the scan report email after a manual scan if auto_email_manual is enabled."""
@@ -108,6 +113,9 @@ def scan_start():
         finally:
             state._scan_lock.release()
     threading.Thread(target=_run, daemon=True).start()
+    _audit("scan_start",
+           f"sources={options.get('sources',[])} profile_id={profile_id!r}",
+           ip=request.remote_addr or "")
     return jsonify({"status": "started"})
 
 
@@ -115,6 +123,7 @@ def scan_start():
 def scan_stop():
     state._scan_abort.set()
     state._google_scan_abort.set()
+    _audit("scan_stop", "", ip=request.remote_addr or "")
     return jsonify({"status": "stopping"})