SIEM export: follow-ups from Task 7325 (account

Found while shipping Task 7325 (SIEM export visibility parity + rebinding) and its live UI check. - **account_slug parity:** the Audit page drops `data.account_slug` when the reader holds no grant on that account (`routes/audit.py::_visible_payload`); the SIEM export sends it as is. Confirm whether a tenant row can name an account outside its org (e.g. an operator-pool account) and, if so, apply the same rule in `audit_visibility` for the export. - **The page counts its own reads:** opening the Audit export tab writes read events into the org, so "Waiting" shows e.g. "4 ready · 16 settling" where most settling rows are the viewer's own page loads. Consider leaving read captures of the SIEM export's own GET out of the export (or of the count). - **Copy:** the tab still says "Sends every activity event"; it now sends what the Audit page shows. Reword to "Sends your audit events…". - **Hidden rows hold the cursor:** hidden rows after the last delivered visible row are rescanned every minute until a visible row follows; consider advancing the cursor past a settled all-hidden tail. Out of scope: new destination types, CommandAudit export, the operator S3 archive. Done means: - Each item above is shipped with a test or closed with a one-line reason.

All 4 SIEM export follow-ups shipped with tests. The export keeps account_slug only for the org's own accounts, the tab's own GET poll no longer lands in the trail, the copy now reads "Sends your audit events", and the cursor moves past a settled all-hidden tail. Quick gate green, reviews passed, UI checked. PR #6033 queued. Draft #7476 filed.