v0.6.6-beta: Audit Log UI & Session Hardening

[DeepZone]

Motivation

• Provide an internal, non-invasive audit trail for administrative and authentication events and make session-cookie handling configurable and hardened for consistent, secure behavior across the app.
• Enable admins to inspect recent operational events while ensuring audit writes never break the primary request flow and sensitive secrets are never recorded.

Description

• Added a centralized audit helper backend/app/core/audit.py which records user_id, action, target_type, target_id, ip_address, user_agent and details_json; failures roll back and are logged but do not abort the main action.
• Instrumented auth and user flows to emit audit events: initial_admin_setup, login_success, login_failed, logout, user_created, user_updated, plus check_executed and report_generated when checks/reports are stored. Changes touch backend/app/api/routes_auth.py, routes_users.py, and routes_checks.py.
• Added admin-only audit API GET /api/audit-log in backend/app/api/routes_audit.py with simple filters (action, user_id, target_type, limit, offset), newest-first sorting and username via join; no sensitive data is returned.
• Frontend: new frontend/src/components/AuditLogView.tsx, frontend/src/api.ts + frontend/src/types.ts additions, and admin-only navigation entry; UI shows time, user, action, target, IP, user agent and details with loading/error/empty states and action/target-type filters.
• Session hardening: replaced hard-coded cookie name with settings.session_cookie_name and used settings.cookie_secure for both set and delete paths; httponly=True and samesite='lax' preserved; token expiry honors SESSION_EXPIRE_HOURS via the auth core. Changes made in backend/app/core/auth.py and backend/app/api/routes_auth.py.
• Tests and docs: added backend tests for audit access/events and cookie behavior, bumped backend/frontend versions to v0.6.6(-beta) and updated README.md, ROADMAP.md, and RELEASE_NOTES.md.

Testing

• Backend unit/integration tests: ran cd backend && pytest -q, result: all tests passed (90 passed).
• Frontend build: ran cd frontend && npm run build, result: production build succeeded.
• Notes: no Docker-specific runtime validation was required in this environment; CI-compatible automated checks (pytest + frontend build) were executed and green.

---

Codex Task