Add a process-local security audit trail to the Windows server's web
console, mirroring the Go server's event names and reply shape. The ring
keeps the most recent 1000 events since process start and is never
persisted.
- New query_audit WebSocket command, admin-only, with time/event/actor/
IP/device/keyword/warn-only filters and pagination; the reply is the
audit_result payload the existing Audit Log page already understands.
The challenge advertises caps.auditLog so browsers enable the button.
- Record logins (success, failure, throttling, salt probes), WebSocket
connect/close, screen and terminal session start/stop/denials,
clipboard transfers (byte counts only), RDP resets, and admin user
mutations.
- Repeated failed logins and username probes are de-duplicated per
connection so scanners cannot flood the ring.
- Audit writes never hold m_ClientsMutex: disconnect paths snapshot the
client identity before the map entry is erased, and offline-device
stops are audited after the clients lock is released.
Co-Authored-By: deepseek-flash
