Audit and realtime updates

Audit history is served from server/api/audit/ (listing, export, member-oriented variants). MCP decisions write rows through the state layer; server/plugins/init.ts subscribes to new audit events for WebSocket fan-out.

Realtime UI updates use server/routes/ws/audit.ts after clients obtain a short-lived ticket (server/api/auth/ws-ticket.get.ts).

Dashboard aggregates live under server/api/dashboard/ (stats, member-stats).