feat(audit): admin audit log (Notification P3)

Append-only who/what/when trail for admin actions + scheduler run summaries,
generalizing QuotaEvent. Logged at ACTION / run-summary granularity — never
per-row (a scheduler run touching thousands of videos is ONE row).

Backend:
- migration 0054_audit_log + AuditLog model (actor_id FK SET NULL, action,
  target_type/id, summary, before/after JSON, created_at).
- app/audit.py: AuditAction constants (single source of truth, i18n'd on the
  client) + record() (adds to the caller's txn) + gc(retention_days).
- producers wired: role change / suspend / delete / invite approve-deny-add /
  demo add-remove-reset / discovery purge (admin.py); config set/reset — secret
  VALUES never logged, key only (config.py); scheduler interval + maintenance
  tune (scheduler routes); sync pause/resume (sync.py); and the scheduler _job()
  choke point writes ONE run-summary row per run — manual runs + errors always,
  automatic runs only when they changed something (no no-op-poll spam).
- retention: audit_gc scheduler job prunes rows older than audit_retention_days
  (sysconfig, default 180; 0 = keep forever).
- admin API routes/audit.py (/api/admin/audit): recent-window list (actor emails
  resolved, System for background) + clear (leaves one tamper-evidence row).

Frontend:
- new admin-only "Audit log" nav page (ScrollText) using the shared DataTable
  (first admin page to reuse it) — sort/filter/paginate/persist, action select
  filter, actor text filter, before→after detail, Clear-all with confirm.
- AuditLog.tsx + auditColumns.tsx + api.adminAudit/clearAudit + AuditRow type.
- trilingual audit + auditActions namespaces (HU/EN/DE) + nav + config-group +
  scheduler job labels; Audit config group (retention days).

backend/app/routes/scheduler.py

@@ -5,7 +5,8 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy import and_, func, or_, select
 from sqlalchemy.orm import Session
 
-from app import quota, state, sysconfig
+from app import audit, quota, state, sysconfig
+from app.audit import AuditAction
 from app.config import settings
 from app.db import get_db
 from app.models import Channel, Subscription, User, Video
@@ -28,7 +29,7 @@ router = APIRouter(prefix="/api/admin/scheduler", tags=["admin"])
 def set_job_interval(
     job_id: str,
     payload: dict,
-    _: User = Depends(admin_user),
+    admin: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Change how often a scheduler job runs (minutes). Persisted as an override and applied
@@ -45,6 +46,11 @@ def set_job_interval(
             detail=f"interval must be between {MIN_INTERVAL} and {MAX_INTERVAL} minutes",
         )
     applied = apply_interval(db, job_id, minutes)
+    audit.record(
+        db, admin.id, AuditAction.SCHEDULER_INTERVAL, target_type="job", target_id=job_id,
+        summary=f"{job_id} → {applied} min/run", after={"interval_minutes": applied},
+    )
+    db.commit()
     return {"id": job_id, "interval_minutes": applied}
 
 
@@ -74,7 +80,7 @@ def run_all_now(user: User = Depends(admin_user)) -> dict:
 @router.patch("/maintenance")
 def set_maintenance_settings(
     payload: dict,
-    _: User = Depends(admin_user),
+    admin: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
     """Admin-tune the maintenance job's rolling re-validation batch (videos re-checked per
@@ -91,7 +97,10 @@ def set_maintenance_settings(
                 f"{state.MAINTENANCE_BATCH_MAX}"
             ),
         )
-    return {"revalidate_batch": state.set_maintenance_batch(db, value)}
+    new = state.set_maintenance_batch(db, value)
+    audit.record(db, admin.id, AuditAction.MAINTENANCE_TUNE, summary=f"revalidate batch = {new}", after={"revalidate_batch": new})
+    db.commit()
+    return {"revalidate_batch": new}
 
 
 @router.get("")