feat(#530): audit out-of-band config changes, group the trail by time

[VijitSingh97]

Closes #530

Targets the v1.11 integration branch; merges to develop after v1.10 ships.

Summary

Extends the #349 Security panel's audit trail to catch changes it never saw, and adds time-based grouping so the trail scales past a flat tail.

Ask 1 — out-of-band detection:

• host-edit: the dashboard's poll loop diffs config.json (the same pre-masked Control channel: move the config merge host-side so the container never mounts plaintext config.json #440 copy the control channel prefills from) against its previous snapshot. A change is "explained" — and stays quiet — only if a commit/applied entry landed in the Stack config editor: change any setting from the dashboard, applied via pithead (incl. P2Pool mode hot-swap) #33 control.log since the last check; anything else (a hand-edit, a pithead apply run from the host CLI) is recorded with the changed key names only, never values.
• rig-edit: the existing per-rig reconcile poll (_reconcile_worker_config, Worker-apply history: reconcile 'accepted' rows to their terminal state (slow rollbacks stay 'accepted' forever) #579) already reads each rig's terminal control-apply outcome (change_id/status/reason) off the enriched feed. A change_id this dashboard never spooled into worker_config (the table only its own worker-apply writes populate) means the rig applied it on its own — recorded naming the worker. Known limitation, not an oversight: RigForge's /status mirror reports only the outcome of a change, not a per-key diff, so unlike host-edit this can't name which setting moved on the rig — only that one did, and which rig.

Both reuse the existing audit_service._clean sanitizer (same whitelist-charset, length-capped treatment as every other audit field) before anything is persisted.

Ask 2 — time grouping + persistence decision:

Added an hour/day/month dropdown to the AuditCard (default "All", so existing behavior is unchanged until an operator opts in). Grouping needed more history than control.log's own trimmed tail (the writers already cap it) can offer, and the out-of-band detections above have no log to live in at all — they're generated in the dashboard container, which only holds write access to the control spool's requests/ leg (results/, audit/, masked/ are read-only mounts, see docker-compose.yml). So:

• New audit_events SQLite table (same pattern as worker_config/payouts/blocks/Dashboard: Worker Inspect page — read/edit each miner's XMRig config over its API, with versioned config history + per-config hashrate stats #185): permanent, no pruning — audit events are human-paced admin actions, not a hot metrics series, matching the precedent those tables already set.
• Each poll cycle opportunistically mirrors control.log's recent entries into this table (INSERT OR IGNORE on the log's own id, idempotent) alongside the two out-of-band kinds.
• /api/audit now merges the live log tail (so a commit that just landed shows with zero lag, no regression) with the persisted table (so grouping can look back further, and out-of-band rows — which never touch the log — show up at all), deduplicated by id.

Deferred

• A live rig producing a real rig-edit audit row end-to-end is not its own tier-4 matrix leg — the underlying mechanism (a direct rig-side edit becoming visible in the enriched feed / masked prefill) is already proven live by the existing #516 row in testing-strategy.md; this PR's detection logic on top of it is unit-tested (tier 1) with a real StateManager.
• rig-edit rows can't name the changed keys (see limitation above) — would need a RigForge-side contract change to expose a per-key diff, out of scope here.

ponytail-review

Ran a pass for over-engineering before opening this PR. One real finding: .card-header-row's comment claimed it was "generic — reuse wherever a card needs one control next to its heading" while it has exactly one caller today. Fixed (dropped the forward-looking framing, kept the one-line class since flexbox-header-row is the natural factoring either way). Nothing else worth cutting — the remaining complexity (secret-sentinel-as-opaque-leaf handling, the whole-second/sub-second timestamp grace window, fail-open on a DB read hiccup, id-based idempotent mirroring) is load-bearing correctness/security logic, not speculative flexibility.

Test plan

• make lint: green (ruff, biome, yamllint, markdownlint, docs-voice, shellcheck/shfmt, taplo). lint-proto could not run — Docker daemon isn't available in this environment (unrelated to this diff; no proto files touched).
• make test: green — dashboard pytest (all tiers), frontend node --test (230/230), pithead shell suite (1541/1541), compose hardening invariants, integration harness self-test, fake-daemon contract test.
• Dashboard coverage: 96.73% (gate: ≥80%).
• Patch coverage (diff-cover vs origin/develop-v1.11, this branch's actual base): 100% (gate: ≥90%).

🤖 Generated with Claude Code