Build a UI for the existing audit log

## Problem

Every sensitive mutation already writes an `AuditLog` row — `auth.register`, `auth.login`, `auth.password_change`, `room.create`, `org.member_add`, `pat.create`, `pat.revoke`, `oidc.authorize`, and more — recording the actor, the action, the target, and relevant metadata. None of it is currently exposed anywhere; it was written for future incident-response tooling but has no reader today, either as an API endpoint or a UI page.

## Proposed solution

- Add a session-only, ABAC-gated `GET /v1/orgs/:orgId/audit-log` endpoint to `apps/api`, restricted to org owners/admins (mirroring how `docs/security.md#audit-log` already describes the data's intended access model).
- Add an "Audit log" page under `apps/app/settings/` or `apps/app/org/:orgId/`, following the existing settings-page pattern (`settings.tsx`, `members-page.tsx`) for layout and data fetching.
- Support basic filtering (by action type, by actor, by date range) rather than a raw unfiltered dump, since this is meant for real incident response.

## References

- [`docs/roadmap.md`](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/roadmap.md) — "Audit log has no UI"
- [`docs/security.md#audit-log`](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/security.md)