Audit log UI for AI agents

When agents act in an account, someone will ask who did what. AuditLog shows the account's events. Rows hold ids and codes; names come from a resolve function you pass. An id it can't resolve, like a removed member, shows as the id, never a guess.

Refusals are rows too, with their reason code, and you can filter to them alone. That's often what an auditor wants first.

DataRetention shows how long each kind of data is kept, read-only, from the service's own policy. DataControls holds export, deleting thread history, and deleting the account.