feat: 审计 CSV 导出 — 用户/API Key/集群操作日志一键下载

新增端点 (read 级, 审计 viewer 角色即可导出):
- GET /audit/users.csv: 账号清单 + 最后登录时间
- GET /audit/apikeys.csv: 密钥清单 (前缀+scope+最后使用+过期)
- GET /audit/cluster-log.csv: 令牌环操作日志时间线
  (seq/time_utc/node/kind/detail/data_json 六列, detail 为人读摘要,
   data_json 保留无损原始载荷)

安全设计:
- RFC4180 转义 (引号/逗号/换行)
- 公式注入防御: =/+/@/tab/- 开头单元格加 ' 前缀
- ISO8601 UTC 时间戳, Excel 直接排序
- 明文密钥不可逆, 仅导出展示前缀

前端:
- UsersView: 账号表/API 密钥表各加「⤓ 导出 CSV」按钮
- ClusterView: 日志导出下拉新增 CSV 选项 (走服务端生成)
- api.ts: downloadAuditCsv() 统一下载管道

测试: csvEscape 全用例 / users+apikeys CSV 内容断言 / 未认证 401

web/src/views/UsersView.vue

@@ -10,7 +10,10 @@
     <section class="card">
       <header class="card-h">
         <h3>账号</h3>
-        <el-button type="primary" size="small" @click="openUserCreate">＋ 新建账号</el-button>
+        <div class="h-actions">
+          <el-button size="small" @click="exportCsv('users')">⤓ 导出 CSV</el-button>
+          <el-button type="primary" size="small" @click="openUserCreate">＋ 新建账号</el-button>
+        </div>
       </header>
       <el-table :data="users" size="small" stripe empty-text="暂无账号">
         <el-table-column prop="username" label="用户名" min-width="140" />
@@ -55,7 +58,10 @@
     <section class="card">
       <header class="card-h">
         <h3>API 密钥</h3>
-        <el-button type="primary" size="small" @click="openKeyCreate">＋ 新建密钥</el-button>
+        <div class="h-actions">
+          <el-button size="small" @click="exportCsv('apikeys')">⤓ 导出 CSV</el-button>
+          <el-button type="primary" size="small" @click="openKeyCreate">＋ 新建密钥</el-button>
+        </div>
       </header>
       <el-table :data="apiKeys" size="small" stripe empty-text="暂无密钥">
         <el-table-column prop="label" label="标签" min-width="140" />
@@ -150,12 +156,23 @@
 <script setup lang="ts">
 import { onMounted, ref } from 'vue'
 import { ElMessage, ElMessageBox } from 'element-plus'
-import { api } from '../api'
+import { api, downloadAuditCsv } from '../api'
 import type { ApiKey, ApiKeyCreated, User } from '../types'
 
 const users = ref<User[]>([])
 const apiKeys = ref<ApiKey[]>([])
 
+// exportCsv streams one of the audit CSV endpoints to a file. Read-level:
+// auditors pull these without any write permission.
+const exportCsv = async (kind: 'users' | 'apikeys') => {
+  try {
+    await downloadAuditCsv(kind)
+    ElMessage.success('已导出 CSV')
+  } catch (e: any) {
+    ElMessage.error('导出失败: ' + (e?.message || e))
+  }
+}
+
 const loadUsers = async () => {
   const r = await api.listUsers()
   users.value = r.users