Add functionality to download role permission audit history as a CSV file

Introduce a new admin-only API endpoint for exporting role permission audit data to CSV, including resolved permission names and UTF-8 BOM for Excel compatibility. Frontend button and backend logic implemented to support this feature.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 0cb48020-8f0c-42bb-8fe8-d638905f7fce
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/g7BgHDL
Replit-Helium-Checkpoint-Created: true

lib/api-spec/openapi.yaml

@@ -1666,6 +1666,70 @@ paths:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
 
+  /roles/{id}/audit.csv:
+    get:
+      operationId: exportRolePermissionAuditCsv
+      tags: [roles]
+      summary: Download permission-change audit entries for a role as CSV (admin)
+      description: |
+        Returns the same audit rows as `GET /roles/{id}/audit` but as a
+        downloadable CSV file with permission IDs resolved to names.
+        Honors the optional `actorUserId`, `from`, and `to` filters
+        identically. Pagination parameters are NOT accepted: the file
+        contains all matching rows up to a server-side cap (currently
+        10,000 — narrow the date range for a longer history).
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+        - in: query
+          name: actorUserId
+          required: false
+          schema:
+            type: integer
+            minimum: 0
+          description: |
+            Restrict results to entries authored by the given user. Use
+            `0` or omit to return entries from any actor.
+        - in: query
+          name: from
+          required: false
+          schema:
+            type: string
+            format: date
+          description: Start date (inclusive, YYYY-MM-DD UTC).
+        - in: query
+          name: to
+          required: false
+          schema:
+            type: string
+            format: date
+          description: End date (inclusive, YYYY-MM-DD UTC).
+      responses:
+        "200":
+          description: |
+            UTF-8 CSV (with BOM) containing columns: timestamp,
+            actor_username, added_permissions, removed_permissions.
+          content:
+            text/csv:
+              schema:
+                type: string
+                format: binary
+        "400":
+          description: Invalid filter parameters
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorResponse"
+        "404":
+          description: Role not found
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorResponse"
+
   /roles/{id}/permissions/impact-preview:
     post:
       operationId: previewRolePermissionsImpact