Audit log

Append-only. Retained 24 months. There is no model-call table here, and that absence is deliberate — a reviewer should be able to see it at a glance.