[#1151] Add tamper-evident privileged audit records - #1157

Summary

• add an append-only audit migration with sequence numbers, predecessor hashes, integrity hashes, and database update/delete protection
• make appendAuditRow serialize each mutation through a PostgreSQL advisory lock and compute the chain hash in the insert statement
• capture target and success/failure outcome fields while preserving actor, tenant, correlation, and redacted before/after context
• add a deterministic chain verifier, defensive in-memory store, recursive secret redaction, repository mapping, rollback migration, and operator documentation

Acceptance criteria

• Each appendAuditRow privileged mutation produces one chained audit row.
• Database trigger rejects application-level updates and deletes.
• verifyAuditChain detects field tampering, broken predecessor links, and sequence gaps.
• Redaction and tenant filtering are covered by focused tests.

Verification

• npx jest --runInBand --forceExit src/services/tamperEvidentAudit.test.ts src/services/auditService.test.ts src/repositories/auditLogRepository.test.ts — 34 tests passed
• scoped ESLint passed for all changed TypeScript files
• scoped Prettier check passed
• npm run db:check-migrations passed (no local database; checksum verification skipped)

The repository-wide typecheck/lint remain blocked by pre-existing baseline issues in src/routes/refresh-token.test.ts:445, src/routes/quotas.ratelimit.test.ts:305, and src/routes/rate-limit.ts:17; none are touched by this PR.

Closes #1151