Add log export for audit logs and SCIM events

Route audit-log and SCIM-event exports through export_jobs with typed
arguments, an iam BuildAndUploadExport/SendExportEmail implementation,
and a concurrent export-job worker with stale recovery. Stream JSONL via
page.WalkAll into S3, and expose the request flow on console, connect,
MCP, and CLI.

Co-authored-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/iam/errors.go

@@ -499,3 +499,24 @@ func NewConnectorNotFoundError(connectorID gid.GID) error {
 func (e ErrConnectorNotFound) Error() string {
 	return fmt.Sprintf("connector %q not found", e.ConnectorID)
 }
+
+type ErrInvalidLogExportTimeRange struct{ message string }
+
+const maxLogExportTimeRangeYears = 1
+
+func NewInvalidLogExportTimeRangeError() error {
+	return &ErrInvalidLogExportTimeRange{message: "from_time must be before to_time"}
+}
+
+func NewLogExportTimeRangeTooLargeError() error {
+	return &ErrInvalidLogExportTimeRange{
+		message: fmt.Sprintf(
+			"export time range must not exceed %d year",
+			maxLogExportTimeRangeYears,
+		),
+	}
+}
+
+func (e ErrInvalidLogExportTimeRange) Error() string {
+	return e.message
+}