Epic: Stage 15 — Audit trail completion

[CaYatur]

Umbrella for finishing the audit trail. Data layer, web/desktop instrumentation, and the desktop viewer already shipped (Stage 15 slices 1-4). Remaining: join/alt aggregation and a gated web endpoint.

[CaYatur]

Closing as complete: both remaining slices shipped earlier.

• Join / alt-account aggregation — PR Audit: join / alt-account aggregation (names + IPs + account counts) #30 (shared/joins.ts pure aggregation over existing player.join events, main/core/joins.ts, IPC audit:joins, desktop Audit view "Joins & alts" mode).
• Gated web endpoint — PR Audit: admin-gated web endpoint for the audit log #32 (owner-only GET /api/audit), later widened to a grantable account-level canAudit permission in PR Audit log as a grantable account-level permission (#45) #59 (Audit as a grantable permission (not owner-only) #45).

Verified present on main: src/shared/joins.ts, src/main/core/joins.ts, ipc.ts auditJoins, web/server.ts /api/audit. No further PR needed.