feat(audit): remove dead Export button or wire it to CSV/JSON

[pachev]

Problem

The Audit Log page has an Export button in the page header
(lib/mast_web/live/audit_live.ex:106), but it does nothing — no
phx-click, no handler, no download. It's a dead affordance and a
landmine for anyone clicking it expecting export.

Options

Pick one:

A) Remove the button

One-liner. Honest UI: the page doesn't export today.

B) Wire it up (CSV + JSON via a small dropdown)

Click opens a dropdown with two choices:

• Download CSV — the visible filtered slice
• Download JSON — same slice, pretty-printed

Behaviour:

• Exports respect the currently active filters (q, event_type,
  subject_type) so the file matches what the user sees.
• Hard cap at e.g. 10k rows to avoid OOM'ing the browser; if the
  filtered slice exceeds the cap, the download contains the most
  recent N and a notice header row / JSON key explaining the cap.
• Implementation sketch: small Mast.Audit.Export module returning an
  iolist; a MastWeb.AuditController.export/2 action streams the
  response with content-disposition: attachment and a date-stamped
  filename (mast-audit-2026-05-23.csv); the LiveView button switches
  to a <.link href={~p"/audit.csv?..."} download> instead of a
  phx-click handler so the browser handles the download natively.

Suggested decision

B if export is genuinely useful (sharing with an auditor, ad-hoc
analysis); A otherwise. We can always add B later when someone
actually asks for it.

Acceptance criteria

If A:

• Button removed from audit_live.ex page header
• No regression in the action slot layout (ui_badge still
  anchors right)

If B:

• Dropdown with CSV + JSON options
• Filters carry through to the exported slice
• Filename includes the date
• Tests for Mast.Audit.Export (shape + filter respect + cap)
• Smoke test that the controller returns 200 with the right
  content-type and content-disposition
• mix precommit green