Audit log

Every fact in this tenant + the SHA-256 chained events that produced it. Per-fact rows expand to /audit/fact/{id} for full hashes, payloads, and the prev_hash trace. Chain integrity is verified end-to-end by python -m event_log.cli verify (Agent 8 v0.1).