Add functionality to download role permission audit history as a CSV file

Introduce a new admin-only API endpoint for exporting role permission audit data to CSV, including resolved permission names and UTF-8 BOM for Excel compatibility. Frontend button and backend logic implemented to support this feature.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 0cb48020-8f0c-42bb-8fe8-d638905f7fce
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/g7BgHDL
Replit-Helium-Checkpoint-Created: true

lib/api-zod/src/generated/api.ts

@@ -2114,6 +2114,37 @@ export const GetRolePermissionAuditResponse = zod.object({
   nextOffset: zod.number().nullable(),
 });
 
+/**
+ * Returns the same audit rows as `GET /roles/{id}/audit` but as a
+downloadable CSV file with permission IDs resolved to names.
+Honors the optional `actorUserId`, `from`, and `to` filters
+identically. Pagination parameters are NOT accepted: the file
+contains all matching rows up to a server-side cap (currently
+10,000 — narrow the date range for a longer history).
+
+ * @summary Download permission-change audit entries for a role as CSV (admin)
+ */
+export const ExportRolePermissionAuditCsvParams = zod.object({
+  id: zod.coerce.number(),
+});
+
+export const exportRolePermissionAuditCsvQueryActorUserIdMin = 0;
+
+export const ExportRolePermissionAuditCsvQueryParams = zod.object({
+  actorUserId: zod.coerce
+    .number()
+    .min(exportRolePermissionAuditCsvQueryActorUserIdMin)
+    .optional()
+    .describe(
+      "Restrict results to entries authored by the given user. Use\n`0` or omit to return entries from any actor.\n",
+    ),
+  from: zod
+    .date()
+    .optional()
+    .describe("Start date (inclusive, YYYY-MM-DD UTC)."),
+  to: zod.date().optional().describe("End date (inclusive, YYYY-MM-DD UTC)."),
+});
+
 /**
  * Given a candidate set of permission IDs for the role, returns the list of
 permissions that would be removed and, for each one, how many users would