Audit log

Append-only SHA-256 hash chain. Every state-changing admin action writes a row sealed with the running hash of all prior rows.