Audit log

Append-only. Every admin action lands here with an actor, target, and structured diff. Tamper-detection: corrupting a row breaks the running Merkle hash.