fix: P2 API hardening — unbounded SELECTs, export audit log, header injection, empty-key guard

- export: add .limit(10000), sanitize filename, write_audit_log on every export
- stats: add .limit(10000) to aggregation query
- settings POST: reject empty string values to prevent silent key deletion

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

app/api/settings/route.ts

@@ -47,8 +47,8 @@ export async function POST(request: NextRequest) {
   if (!body.key || !ALLOWED_KEYS.includes(body.key as SettingKey)) {
     return NextResponse.json({ error: 'Invalid key' }, { status: 422 })
   }
-  if (typeof body.value !== 'string') {
-    return NextResponse.json({ error: 'value required' }, { status: 422 })
+  if (typeof body.value !== 'string' || body.value.trim() === '') {
+    return NextResponse.json({ error: 'value must be a non-empty string' }, { status: 422 })
   }
 
   const { error } = await supabase.from('app_settings').upsert({