Audit log entity labels expose account names and emails to `audit_log.view` holders

[antosubash]

worktree-hifi-pages gave the audit table entity labels instead of raw uuids: resolve_entity_labels
asks each module's registered AuditLink to name its own rows
(modules/audit_log/audit_log/resolve.py:1-16), and the users module's resolver answers with
full_name or email (modules/users/users/audit.py:28-53, wired at
modules/users/users/module.py:121-128).

The audit views are gated on audit_log.view alone
(modules/audit_log/audit_log/endpoints/views.py:67, PERM_VIEW = "audit_log.view" at
modules/audit_log/audit_log/constants.py:22). A role granted audit access but not users.view can
therefore read the display name — and, for accounts with an outstanding invite where full_name is
still null, the email address — of every account that appears as an audit subject. The same is true
of the actor column (resolve.py:38-55), which is arguably intended: an audit trail that will not say
who acted is not one. The entity column is a wider surface, since it names people who were merely
edited, and the same resolver also feeds the users edit page's "Recent activity" list.

What would fix it: decide explicitly whether audit_log.view implies "may see who the audited
accounts are". If it does, say so in the permission's description so it is granted knowingly. If it
does not, have resolve_entity_labels take the requesting principal and fall back to the short id for
entity types whose owning module declares a permission the caller lacks.

Also worth doing while in the file: modules/audit_log/audit_log/pages/Browse.tsx is 286 lines
against the repo's 300-line cap (scripts/check_file_size.py:27), so the next change to it is likely
to be a split under time pressure rather than by design.