- New AuditConfig.retention_days: optional int > 0 (default None)
- AuditLogger prunes entries older than N days at startup + opportunistic
  during log() writes (throttled to once per hour)
- Covers current audit.jsonl + rotated backups (.1 / .2 / .3)
- Fail-safe: malformed lines kept (never silently drop unparseable data)
- Atomic rewrite via .tmp + os.replace; fsync before swap
- Config examples + README updated (Quickstart + Config + Audit sections)
- +6 unit tests (280 total), ruff clean