fix: harden CMS security controls

cms/logs/.htaccess

@@ -0,0 +1,2 @@
+# Audit entries contain usernames, addresses, and operational detail; keep them private.
+Require all denied

cms/logs/index.php

@@ -1,2 +1,4 @@
 <?php
-header("Location: /cms/");
+// Audit logs are not a public attraction; return to the authenticated CMS instead.
+http_response_code(404);
+header("Location: /cms/");