Feature: In-memory web audit log for the MFC server

Add a process-local security audit trail to the Windows server's web
console, mirroring the Go server's event names and reply shape. The ring
keeps the most recent 1000 events since process start and is never
persisted.

- New query_audit WebSocket command, admin-only, with time/event/actor/
  IP/device/keyword/warn-only filters and pagination; the reply is the
  audit_result payload the existing Audit Log page already understands.
  The challenge advertises caps.auditLog so browsers enable the button.
- Record logins (success, failure, throttling, salt probes), WebSocket
  connect/close, screen and terminal session start/stop/denials,
  clipboard transfers (byte counts only), RDP resets, and admin user
  mutations.
- Repeated failed logins and username probes are de-duplicated per
  connection so scanners cannot flood the ring.
- Audit writes never hold m_ClientsMutex: disconnect paths snapshot the
  client identity before the map entry is erased, and offline-device
  stops are audited after the clients lock is released.

Co-Authored-By: deepseek-flash

server/web/index.html

@@ -4532,8 +4532,8 @@
 
         // Show the admin-only toolbar buttons (Users / Audit Log). Called after
         // login, SSO restore, logout and capability negotiation. The audit
-        // button also requires the server capability: the C++ server does not
-        // implement query_audit.
+        // button also requires the server capability (auditLog); servers that
+        // do not implement query_audit simply never advertise it.
         function updateAdminButtons() {
             const admin = currentUserRole === 'admin';
             const usersBtn = document.getElementById('users-btn');