docs(readme): document admin audit history and export surfaces

[jussaw-hermes-agent]

Finding

AUD-20260728-03 — Web README understates the available admin audit and export surfaces

Summary

Updates the web/ app-structure listing in web/README.md so its admin/ entry reflects the audit-history and export surfaces already present in the application.

Rationale

The existing admin/ line named login, players, games, and settings but omitted the protected audit history at /admin/audit and the authenticated CSV/JSON export endpoint at /admin/export. This documentation-only correction makes those implemented administrative capabilities discoverable without changing their behavior.

Implementation details

• One-file, one-line change in web/README.md.
• Documents protected audit history at /admin/audit.
• Documents authenticated CSV/JSON export at /admin/export.
• No source, route, runtime, configuration, dependency, database, or deployment behavior changed.

Acceptance checklist

• README admin structure guidance accurately identifies audit history and export capabilities.
• Audit history and export descriptions were verified against the current source and auth protections.
• No route, configuration, or behavior changes are included.

Validation

• git diff --check — passed.
• git show --check on the committed revision — passed.
• pnpm exec prettier --check README.md from web/ — failed only for pre-existing unchanged Markdown table formatting; the exact origin/main README reproduces the same failure. The changed admin line is not among Prettier's proposed formatting ranges.
• Fresh independent latest-Opus (claude-opus-4-8) revalidation/review approved the committed scope before publication; no material correctness, security, or scope issues found.

Screenshots

Screenshots: Not applicable — no user-visible UI changes.

Accessibility, security, and privacy

• Accessibility: No rendered UI changes.
• Security: The routes remain protected/authenticated exactly as before; this PR documents, rather than alters, those controls.
• Privacy: No data collection, processing, or exposure behavior changes.

Risks and tradeoffs

Minimal documentation-only risk. The long admin/ description retains the existing one-entry-per-line structure-tree style rather than introducing unrelated formatting changes.

Migration, rollout, and rollback

No migration, rollout action, or deployment behavior is required. Rollback is a single-commit revert with no state to unwind.

Limitations and follow-ups

This PR intentionally does not reformat the pre-existing README table debt because it is outside the approved one-line documentation scope. Deeper usage documentation for audit/export can be handled separately if desired.