Get audit log entry counts

Returns aggregate counts of audit log entries per time bucket. Used for dashboard overlays that show flag targeting changes.