feat: Track S frontend - permission core + Audit & Security section

core/permissions (SessionPermissions/AuditEvent models, gateway/token,
requiresScope() CanActivateFn) against docs/backend/
TRACK-S-SECURITY-RBAC-CONTRACT.md §1-3. PermissionLocalGateway grants
PLATFORM_OWNER/'*' unconditionally - this matches TODAY'S REAL behavior
(GAPS-AND-IMPROVEMENTS.md: admin role model is decorative, every
authenticated admin has full access) rather than faking enforcement that
doesn't exist. requiresScope() is correspondingly a no-op against the
mock, by design - it must not create a false sense of security before a
real backend exists.

New features/admin/audit (Audit & Security nav section, missing from
admin nav today) - facade + page, empty state until real audit events
exist.

Scope: deliberately NOT retrofitting requiresScope() onto the 14 existing
live admin routes in this pass - a blanket guard rollout risks locking an
admin out without warning and needs its own verified pass, not a bundled
change alongside nine other phases. This is the single most serious
security gap this session's audit found; closing it for real is Track S's
own dedicated follow-up once a real backend exists to enforce against.

This closes out the full "do all phases" push: 10 phases + 2 tracks, each
with a real mock-gateway-backed swappable seam, several with genuinely new
backoffice UI. Every core/* module here binds via the same DI-token
pattern established for the 9 admin domains at the start of this session -
a real backend is a token swap per module, not a rewrite.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/i18n/en.ts

@@ -2063,6 +2063,7 @@ export const en: Translations = {
       integrations: 'Integrations',
       finance: 'Payments & Finance',
       marketplaces: 'Marketplaces',
+      audit: 'Audit & Security',
       reviews: 'Reviews',
       reports: 'Reports',
       partnersGroup: 'Partners',

src/app/i18n/hy.ts

@@ -2057,6 +2057,7 @@ export const hy: Translations = {
       integrations: 'Ինտեգրումներ',
       finance: 'Վճարումներ և ֆինանսներ',
       marketplaces: 'Մարկետփլեյսներ',
+      audit: 'Աուդիտ և անվտանգություն',
       transactions: 'Գործարքներ',
       reviews: 'Կարծիքներ',
       reports: 'Հաշվետվություններ',

src/app/i18n/ru.ts

@@ -2057,6 +2057,7 @@ export const ru: Translations = {
       integrations: 'Интеграции',
       finance: 'Платежи и финансы',
       marketplaces: 'Маркетплейсы',
+      audit: 'Аудит и безопасность',
       transactions: 'Транзакции',
       reviews: 'Отзывы',
       reports: 'Отчёты',

src/app/i18n/translations.ts

@@ -2072,6 +2072,7 @@ export interface Translations {
       integrations: string;
       finance: string;
       marketplaces: string;
+      audit: string;
       reports: string;
       partnersGroup: string;
       sellerManagement: string;