Show user IDs separately in audit log search results

[yummybomb]

Summary

• add a dedicated User ID column to the default audit log search table
• keep the User column email-only and show - when an email is unavailable instead of repeating the user ID
• cover the displayed user ID and missing-email fallback in tests

Test plan

• make test
• make build
• ./bin/kernel audit-logs search --limit 3 --no-color

---

Note

Low Risk
CLI-only presentation change for audit log search; no API or auth behavior changes.

Overview
kernel audit-logs search table output now has a dedicated User ID column populated from entry.UserID, so identifiers are visible even when an email is present.

The User column is email-only: it shows the address when available and - when it is not, instead of reusing the user ID in that column. JSON output is unchanged.

Tests assert user_123 appears in search table output and that formatAuditLogUser returns - when email is missing.

^{Reviewed by Cursor Bugbot for commit 3d0e976. Bugbot is set up for automated code reviews on this repo. Configure here.}