feat: audit log for sensitive operations

[kacy]

adds an append-only audit log so operators can see who did what: secret
changes, app apply/rollback, agent join/drain, policy changes, and
backup/restore. first half of the audit-log item in next-steps.md.

summary

• new audit_log table (via migration) + store appendAuditEntry/
  listAuditEntries helpers, newest-first with a limit.
• src/state/audit.zig records ops under a threadlocal actor so concurrent
  API requests never clobber each other's identity. the actor is coarse today
  (no RBAC yet): api-token / join-token / local (CLI) / unauthenticated.
  the actor column is free-text so a named-token identity drops in later.
  recording is best-effort — a storage failure is logged, never propagated, so
  auditing can't break the operation it records.
• dispatch() tags each request with the caller's actor from the existing auth
  flags; CLI processes default to local.
• hooks at the sensitive op sites (secrets, policies, app apply/rollback, agent
  register/drain, backup/restore/secret-rotate).
• GET /v1/audit?limit=N (default 50, max 500) returns recent entries, gated by
  the api token like other /v1 routes.

audit entries are local to the node that performed the op (the control-plane
leader is the authoritative record). cluster-wide aggregation and
retention/rotation are follow-ups.

tested

• YOQ_SKIP_SLOW_TESTS=1 zig build test — 2175 passed, 2 skipped, 0 failed.
• unit tests: append/list round-trip (newest-first, limit, null target);
  record writes under the set actor; actor defaults to local and resets;
  /v1/audit route dispatch + method-not-allowed; backup validator accepts the
  new table (count 20).
• zig fmt --check clean.

follow-up

yoq audit CLI to read the log from the terminal (next PR); that PR will also
cover the HTTP round-trip end to end.