ONTO-RECONCILE-1 Phase 6 — bounded audit aggregation over a time window. Two substrate queries (counts grouped by action+actor; recent-actions LIMIT N). `recent_actions` rows expose only metadata-shaped fields per the privacy contract — caller-supplied content (`evidence_ref`, `before_json`, `after_json`) is excluded. Authentication: routes inherit `ScopePolicy.team_required` from `create_router(...)`'s default — verified at base_router.py:62. Audit data is workspace-scoped via FalkorDB graph_name isolation. Note on `group_by`: today the substrate always groups by `(action, actor)` jointly and folds into `by_action` and `by_actor`. The parameter is accepted (and validated against {"action", "actor"}) for forward compatibility, but additional grouping is not yet implemented.