v1.9.421 — modularize audit to lib/audit.js (UR-0125)
Second large-handler extraction for bin heaviness: moved the 310-line audit handler to lib/audit.js via DI (test-driven, zero missing deps). bin 20903 to 20617 lines (cumulative -560). Behavior unchanged. selftest 166 to 167, e2e 420 to 421, zero regression.