🧹 chore: Spell CSV_BOM as  and drop a gratuitous optional chain

`revokeCapability` is typed `Promise<{ deletedCount: number }>` so the
`?.` on `revokeResult?.deletedCount` only obscured that the value cannot
be nullish.

`CSV_BOM` was a literal U+FEFF character invisible in most editors. Now
spelled as the Unicode escape so readers can see the constant; the test
that asserts on the first emitted chunk uses the same escape.

packages/api/src/admin/auditLog.spec.ts

@@ -423,7 +423,7 @@ describe('createAdminAuditLogHandlers', () => {
 
       await handlers.exportAuditLogCsv(ctx.req, ctx.res);
 
-      expect(ctx.chunks[0]).toBe('');
+      expect(ctx.chunks[0]).toBe('\uFEFF');
       expect(ctx.chunks).toContain('\r\n');
       expect(ctx.endCalled()).toBe(true);
     });

packages/api/src/admin/auditLog.ts

@@ -15,7 +15,10 @@ import type { Response } from 'express';
 import type { ServerRequest } from '~/types/http';
 
 const FORMULA_PREFIX = /^[=+\-@\t\r]/;
-const CSV_BOM = '';
+/** UTF-8 BOM, written first so Excel recognizes the encoding on import. Spelled
+ * as a Unicode escape so readers can see the constant in editors that hide
+ * the zero-width glyph. */
+const CSV_BOM = '\uFEFF';
 
 const VALID_ACTIONS = new Set<AuditAction>(AUDIT_ACTIONS);
 const VALID_PRINCIPAL_TYPES = new Set<string>(Object.values(PrincipalType));

packages/api/src/admin/grants.ts

@@ -450,7 +450,7 @@ export function createAdminGrantsHandlers(deps: AdminGrantsDeps): {
       // Only emit the audit entry when a grant document was actually deleted —
       // a no-op revoke (the grant never existed) must not appear in the audit
       // trail or the forensic record becomes misleading.
-      if (revokeResult?.deletedCount > 0) {
+      if (revokeResult.deletedCount > 0) {
         await emitAudit({
           action: 'grant_removed',
           caller,