Add provider-target parity audit

[cbusillo]

Summary

• Adds a read-only provider-target parity audit workflow that compares explicit physical provider-target rows with Dokploy target/id projections.
• Exposes launchplane storage provider-target-audit with JSON output, filter support, schema initialization, and nonzero exit for blockers.
• Documents the audit as the Phase Two preflight before backfill or provider-target authority cutover.

Safety

• Blocks missing provider-target rows, partial Dokploy pairs, conflicting explicit rows, and zero-match filtered audits.
• Treats non-Dokploy physical provider-target rows as future-provider warnings instead of comparing them to Dokploy projections.
• Does not mutate runtime records or change live deploy/promotion authority.

Refs #1100
Refs #1101

Validation

• uv run python -m unittest tests.test_provider_target_audit
• uv run python -m unittest tests.test_provider_target_audit tests.test_postgres_store.PostgresRecordStoreTests.test_provider_target_records_project_from_dokploy_records tests.test_postgres_store.PostgresRecordStoreTests.test_provider_target_physical_storage_precedes_dokploy_projection tests.test_postgres_store.PostgresRecordStoreTests.test_provider_target_filter_suppresses_shadowed_dokploy_projection tests.test_postgres_store.PostgresRecordStoreTests.test_provider_target_list_combines_physical_and_projected_records tests.test_postgres_store.PostgresRecordStoreTests.test_provider_target_list_skips_incomplete_dokploy_pairs
• uv run --extra dev ruff check control_plane/workflows/provider_target_audit.py control_plane/storage/postgres.py control_plane/cli_storage_secrets.py tests/test_provider_target_audit.py docs/records.md docs/operations.md --diff
• uv run --extra dev ruff check control_plane/workflows/provider_target_audit.py control_plane/storage/postgres.py control_plane/cli_storage_secrets.py tests/test_provider_target_audit.py
• uv run --extra dev mypy control_plane tests/test_provider_target_audit.py
• uv run python -m unittest (1934 tests)