Streams the rows GET /api/v3/audit/tenants/{tenantId}/events would serve for the
same parameters - the same window, the same filters, the same admitted sources
and the same (event_timestamp DESC, event_source, log_id DESC) ordering - as one
RFC 4180 CSV.

startTime and endTime are REQUIRED: an export is a bulk read and it is bounded
by a window the caller states.

It takes the SAME source and dimension filters as the feed, and applies them the
same way: a file exported from a tab holds that tab's rows, because "the export
emits exactly the feed's rows" is only true when both are built from one
parameter set by one query builder.

There is no cursor parameter. An export is not paged, and silently ignoring a
cursor would emit a different row set than the caller believes they asked for,
so passing one is answered 400.

The response carries X-Export-Row-Ceiling before the first row, and
X-Export-Rows and X-Export-Truncated after the last. An ABSENT header means
UNKNOWN, never complete: a container discards a header set on a committed
response. The file's own last record is the durable answer.

The details column of the feed is deliberately NOT exported.