feat(ui): link audit events to MCPAccessGrant and MCPAgentSession detail pages

## Summary

Once audit events carry `matched_grant` and `matched_session` fields (see companion issue), wire up the Sentinel UI so users can navigate from an audit event directly to the grant or session object that caused it.

## Motivation

Right now the UI shows audit events (ClickHouse) and cluster objects (MCPAccessGrant, MCPAgentSession) as completely separate views. You cannot click from a deny event to understand *why* — you have to manually look up the grant in a different screen.

This connects the three pillars of the platform that are currently siloed:

```
MCPAgentSession ←——→ Audit Events ←——→ MCPAccessGrant
```

## UI changes

### Audit event row
- `matched_grant` value → clickable link → `MCPAccessGrant` detail page
- `matched_session` value → clickable link → `MCPAgentSession` detail page

### MCPAccessGrant detail page
- Add **"Recent activity"** tab: audit events matched against this grant (last 7 days), with allow/deny breakdown

### MCPAgentSession detail page
- Add **"Tool call timeline"** tab: ordered list of every tool call in this session with allow/deny/would_deny status

## Dependencies
- Requires `matched_grant` + `matched_session` fields in audit events (feat(audit): matched grant and session attribution in audit events)

## Acceptance criteria
- [ ] Audit event table shows `matched_grant` and `matched_session` as clickable links
- [ ] Clicking `matched_grant` navigates to the grant detail page
- [ ] Clicking `matched_session` navigates to the session detail page
- [ ] Grant detail page shows recent audit activity filtered by that grant
- [ ] Session detail page shows full tool call timeline for that session

🤖 Generated with [Claude Code](https://claude.com/claude-code)