Incremental audit collection

The efficient pattern for a continuous audit feed is cursor-based:

GET /api/bng/audit/timeline?since=<t0>&limit=1000
  → note the returned `cursor`

GET /api/bng/audit/timeline?since=<t0>&since_cursor=<cursor>&limit=1000
  → only entries newer than the cursor; note the new `cursor`

Three cautions. Advance since as well as the cursor, or the window will grow
without bound and the backend will re-merge an ever-larger span. Check
truncated — if it is true, entries were dropped from the oldest end and the
window should be narrowed or the limit raised. And check the per-source ok
flags: a degraded source produces a silently incomplete timeline, which for a
compliance feed is worse than an error.

For genuine compliance archival, prefer configured audit shipping over
polling. It is push-based, spooled, retried, and survives restarts and log
rotation.