docs: audit retention/immutability, admin audit queries, alert sink, CC admin exclusion, identity linking (tmi#453 #400 #398 #395 #399 #383)