Resolve all 46 low-severity architecture review findings

docs/requirements/Component-AuditLog.md

@@ -641,7 +641,10 @@ MS SQL for direct-write events). Unredacted secrets never persist.
   silently skipped (the global switch already covers them). The DELETE runs under
   `scadabridge_audit_purger` (the maintenance role); the append-only writer role
   is unaffected. Batch size is configurable via
-  `AuditLog:Purge:ChannelPurgeBatchSize` (default 5000). Each channel override
+  `AuditLog:Purge:ChannelPurgeBatchSize` (default 5000). Each channel deletes at
+  most `AuditLog:Purge:MaxPurgedRowsPerChannelPerTick` rows (default 50,000;
+  must be positive), including a smaller final batch when needed. Remaining
+  backlog resumes on the next tick so later channels are not starved. Each channel override
   runs in its own try/catch, mirroring the per-boundary error-isolation of the
   partition switch-out loop. Values are validated to be in
   `[30, RetentionDays]`; keys that are not a recognized `AuditChannel` enum name
@@ -772,7 +775,8 @@ size:
 "AuditLog": {
   "Purge": {
     "IntervalHours": 24,
-    "ChannelPurgeBatchSize": 5000
+    "ChannelPurgeBatchSize": 5000,
+    "MaxPurgedRowsPerChannelPerTick": 50000
   }
 }
 ```