Audit log

Append-only trail of privileged actions. Chain verification proves no rows were rewritten.