v0.27.0 — the risk trail

Monitor mode has been running for weeks and producing nothing: every risk decision went to Log::info, production runs LOG_CHANNEL=stderr with no aggregation, and each rollout destroyed the corpus. There was no way to set an enforcement threshold from evidence.

Risk decisions now persist to a risk_decisions table with the score, outcome, the mode the decision was made under, and the per-signal weighted points — so a signal can be re-weighted, not just the threshold moved. docs/security/adaptive-risk.md carries five tuning queries, each executed against real PostgreSQL.

Deliberately not the audit chain: those appends lock the chain head, and these writes happen before authentication, so an unauthenticated burst could serialise the tamper-evident trail of everyone who is authenticated.

IP and email are both keyed HMAC pseudonyms; the mail domain stays clear for provider-abuse patterns. 90-day retention. RISK_MODE stays monitor — enforcement is the decision this data exists to inform.