Add compliance audit log

Immutable audit_log table in the scanner DB records every significant
admin action (profile save/delete, token create/revoke, PIN changes,
source add/update/delete, scheduler job changes, scan start/stop, SMTP
save, dispositions, item delete/redact). GET /api/audit_log exposes
entries newest-first. New Audit Log tab in the Settings modal renders
the table on demand. Settings modal widened 540→640 px and tab labels
set to white-space:nowrap so the six-tab row fits on one line.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routes/scheduler.py

@@ -4,6 +4,10 @@ Scheduler API routes — multi-job CRUD, status, history, run-now.
 from __future__ import annotations
 from flask import Blueprint, jsonify, request
 import sys, os, threading
+try:
+    from gdpr_db import log_audit_event as _audit
+except ImportError:
+    def _audit(*a, **kw): pass  # type: ignore[misc]
 
 bp = Blueprint("scheduler", __name__)
 
@@ -52,6 +56,9 @@ def scheduler_jobs_save():
                         _sched().reload()
                     except Exception:
                         pass
+                    _audit("scheduler_job_save",
+                           f"id={job_id!r} name={jobs[i].get('name','')!r}",
+                           ip=request.remote_addr or "")
                     return jsonify({"ok": True, "job": jobs[i]})
         # New job
         job = sm._new_job(data)
@@ -61,6 +68,9 @@ def scheduler_jobs_save():
             _sched().reload()
         except Exception:
             pass
+        _audit("scheduler_job_save",
+               f"id={job.get('id','')!r} name={job.get('name','')!r}",
+               ip=request.remote_addr or "")
         return jsonify({"ok": True, "job": job})
     except Exception as e:
         import traceback
@@ -81,6 +91,7 @@ def scheduler_jobs_delete():
             _sched().reload()
         except Exception:
             pass
+        _audit("scheduler_job_delete", f"id={job_id!r}", ip=request.remote_addr or "")
         return jsonify({"ok": True})
     except Exception as e:
         import traceback