[BUG-22] Audit log retention set to 730 days instead of required 7 years for federal systems

## BUG-22 — Audit Log Retention Insufficient (730 days vs. 7 years)

**Category:** Bug — MCP Code | **Priority:** Medium

### Observation
Audit log retention is configured for 730 days (2 years). Federal system requirements (NARA, FedRAMP, DoD) mandate audit log retention for a minimum of 3–7 years depending on system classification.

### Evidence
- Issue #636 — audit retention observed at 730 days (O1 finding)

### Impact
Audit logs will be purged before the required retention period, creating compliance gaps and limiting forensic investigation capability.

### Acceptance Criteria
- [ ] Audit log retention configurable per environment
- [ ] Default for federal systems set to ≥ 7 years (2,555 days)
- [ ] Retention policy documented in system configuration
- [ ] Warning surfaced if retention is set below federal minimums