auth/cell_audit_actions.ts

cell_audit_list handler — per-cell audit timeline read.

Authz is manage-tier (can_manage_cell = admin / owner), NOT can_view_cell. The timeline surfaces the actor_id of every account that touched the cell (including via cell_field / cell_item / clone edges where the cell is the target / child / source); exposing that to mere viewers — or, for a public cell, to any authenticated caller — leaks who-touched-what. Gating to admin / owner mirrors cell_grant_list ("the audit trail is the manager's to read"). Misses + unauthorized reads both 404 with cell_not_found — private-cell existence stays masked. No audit side effect (read-only).