refactor(auth): deepen audit-log verification behind a shared core

[allisson]

Pull Request

Summary

• Deepen audit-log signature verification: extract the single verify-one-log core (verifyAuditSignature + a signatureStatus enum) that both VerifyIntegrity (single) and VerifyBatch (batch) route through, so the tamper-detection logic has one locality instead of two divergent copies.
• Behavior fix (divergence): batch verification previously lumped KEK-missing logs into invalid_count. It now reports them in their own kek_missing_count / kek_missing_logs bucket, agreeing with single-log verification (ErrKekNotFoundForLog). A KEK-missing log still fails the integrity check (it cannot be proven authentic) — only the classification differs.
• Add the first focused unit test surface for the tamper path (valid / tampered / legacy-unsigned / KEK-missing) and a batch KEK-missing classification test.
• CLI verify-audit-logs text + JSON output gains the Kek Missing / kek_missing_* fields.

Validation

• Relevant tests pass locally: go test ./internal/auth/... ./cmd/...
• Integration TestAuditLogSignature passes against Postgres (make test-db-up / go test -tags integration ./test/integration/ -run TestAuditLogSignature / make test-db-down)
• go build ./..., go vet, gofmt clean

Documentation Quality Gate

• Documentation updated for behavior/contract changes (docs/cli-commands.md JSON example)
• Last updated metadata refreshed in changed docs pages — n/a, no such metadata in docs/cli-commands.md
• CHANGELOG.md updated for significant docs changes — added an Unreleased entry
• make docs-lint passes locally — not run (docker-dependent)
• Examples/commands were validated or reviewed for accuracy