Jul 22 - Update - add audit viewer, CSRF lifetime

README.md

@@ -171,12 +171,17 @@ Then visit `https://your-domain/admin`, sign in, and manage content.
   (image / video / embed), caption, an optional link button, and sort order.
 - **Add / edit section** — number (`§NN`, unique), title, subtitle, sort order.
 - Deleting a section cascades to its topics (with a confirm prompt).
+- **Audit log** (`/admin/audit`, "Audit" in the nav) — read-only view of every
+  change, newest first, filterable by action and type, paginated 50/page. Times
+  are UTC.
 
 ### Notes
 
 - `SESSION_COOKIE_SECURE=1` means the login cookie only sends over HTTPS. For a
   quick plain-HTTP test on the box, set it to `0` — never in production.
 - `SECRET_KEY` must be stable and secret; changing it logs everyone out.
+- `WTF_CSRF_TIME_LIMIT` blank keeps a token valid for the whole session, so a
+  long edit never 400s on save; set an integer (seconds) to re-enable expiry.
 - The admin routes live under `/admin`; the public page and `schema.sql` SQL
   workflow above still work unchanged.