audit [--actor <user>|-] [--action <prefix>] [--since <duration|date>] [--limit <n>]. --actor - selects actorless rows (host, auth failures). --since takes 30m, 24h, 7d, a date, or RFC 3339. The host-local command already dispatches into the registry after !153, so it gains the same flags and --json for free; the e2e test asserts it.
Wiki: Admin page updated, pushed with the merge.
Closes #73