feat(audit): read-only `sshx audit query/export` consumption surface

[jamiesun]

Background

Audit JSONL is written by default under ~/.sshx/audit, but there is no consumption surface — governance loops (human review, agent self-inspection, incident reconstruction) currently require hand-rolled jq.

Plan

• sshx audit query: read-only filters — --since/--until, --target, --action, --run-id, --error-kind, --bypass-only; outputs table for humans, --json/JSONL for agents.
• sshx audit export: bounded export of matching events to a file (JSONL), for handoff to SIEM-adjacent tooling — sshx itself stays not-a-SIEM per the non-goals.
• Strictly read-only: no retention management, no rotation, no upload.

Acceptance

• Query filters compose; empty result is exit 0 with empty array in JSON mode
• E2E: execute → query by run_id → assert the audit trail fields
• Docs page under docs/ + usage help