Add comprehensive ISAC audit logging

docs/DESIGN_SYSTEM.md

@@ -216,6 +216,12 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
   must never be able to grant `system.admin`; both option visibility and
   server-side validation enforce this boundary. Role mutations are recorded in
   the audit log with their previous and resulting permission sets.
+- Audit History belongs to a separate `SYSTEM OVERSIGHT` navigation domain.
+  Audit records are append-only operational evidence and show the operator,
+  categorical action, target identifier, timestamp, and expandable before/after
+  JSON snapshots. Search and category/action filters run before pagination.
+  The Auditor role grants read-only `audit.view` access plus entry to ISAC;
+  audit visibility never implies mutation, user-management, or game-data access.
 - Account deletion uses a collapsed danger zone, explicit identity confirmation,
   and plain-language retention guidance. Soft-deleted accounts retain authored
   content under a deleted-agent identity while releasing credentials, usernames,