Audit events have no retention policy and no bulk export

[Bccorb]

Part of #155. Session 7. Gated on purchasing the GovRAMP Security Snapshot.

Problem

There is no retention configuration, no archival and no purge for auth_events.
A search for retention or purge logic across src finds only OAuth state cleanup.
The table grows without bound and nothing can be defensibly deleted.

Separately, Phase 5 of the migration runbook promises an annual evidence package
including "exportable audit event history for the period." There is no export
endpoint. GET /admin/auth-events
(src/controllers/admin.ts:593) is a paginated JSON
listing, which is not the same thing.

Why it matters

NIST 800-53 AU-11. For Maryland specifically, authentication audit events are
records, and retention must map to state records retention schedules rather than to
a product default. This is open decision 8 in the migration runbook and it cannot be
answered until there is a retention setting to answer it with.

What to do

• Add a configurable retention period, with archival before deletion rather than
  hard purge
• Add a bulk export endpoint producing a stable, complete format suitable for
  handing to an auditor, not a paginated listing
• Document the mapping to a records retention schedule once a jurisdiction's
  schedule has been read

Acceptance

• Retention is configurable per deployment
• Expiry archives rather than silently deletes
• An operator can export a complete period in one operation

Freeze status

Anticipated GovRAMP finding (exception 2). Also a runbook commitment (exception 4).

Ripple

New route, so seamless-auth-server needs passthrough in all three adapter
allowlists.