Audit trail

Every _emit_event call mirrored into a rolling in-memory audit log (last 5000 entries). Filter by actor / aggregate / time range. The examiner runs /audit/examiner/sql to materialise compliance.audit_v2 from events.events.