feat(ui): E-1a complete stubbed features

- Wire Install button to POST /updates/:id/install (F-E1-4)
  Loading state, toast notifications, list refresh on success
- Wire Logs button to GET update logs endpoint (F-E1-5)
  Expandable log panel with formatted output
- Wire downloads.go signed package lookup to DB (F-E1-1)
  Queries GetSignedPackage when version parameter provided
- Implement GetSecurityAuditTrail with real DB query (F-E1-7)
  Queries security_settings_audit table via service layer
- Resolve GetSecurityOverview placeholder (F-E1-8)
  Raw pass-through confirmed correct design (dashboard uses
  separate SecurityHandler.SecurityOverview endpoint)

All tests pass. No regressions from A/B/C/D series.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/E1a_Fix_Implementation.md

@@ -0,0 +1,28 @@
+# E-1a Stubbed Features Completion
+
+**Date:** 2026-03-29
+**Branch:** culurien
+
+---
+
+## Files Changed
+
+### Frontend
+| File | Change |
+|------|--------|
+| `AgentUpdates.tsx` | Install button wired to `updateApi.installUpdate()`, Logs button wired to `updateApi.getUpdateLogs()`. Loading states, toast notifications, logs display panel added. |
+
+### Server
+| File | Change |
+|------|--------|
+| `downloads.go` | Signed package DB lookup wired (F-E1-1). Queries `GetSignedPackage` when version parameter provided. |
+| `security_settings.go` | `GetSecurityAuditTrail` now queries `security_settings_audit` table (F-E1-7). `GetSecurityOverview` placeholder comment updated — raw pass-through is correct design (F-E1-8). |
+| `security_settings_service.go` | Added `GetAuditTrail(limit)` method, added `models` import. |
+| `queries/security_settings.go` | Added `GetAllAuditLogs(limit)` query function. |
+
+## Notes
+
+- `installUpdate` and `getUpdateLogs` already existed in `api.ts` — only the UI buttons needed wiring.
+- No frontend test framework exists (no vitest/jest in package.json). Frontend tests are a TODO for E-1b.
+- F-E1-8 resolved as "working as intended" — the settings overview raw pass-through is correct; the dashboard overview is a separate endpoint (`SecurityHandler.SecurityOverview`).
+- All server tests pass. No regressions.