feat(P04): audit log + persistence hardening

Implements Phase 4 of v0.1 Foundation:
- internal/store/migrations/0003_audit_log.sql: audit_log table with indexes
- internal/store/audit_repo.go: AuditRepo (Append + List)
- internal/store/audit_repo_test.go: 2 tests for audit persistence
- internal/engine/audit.go: Audit wrapper that persists to SQLite AND logs via slog
- internal/cli/audit.go: orca audit list command (text + JSON)
- Registry now records every join/leave/forget with actor/action/resource/result

Verified: audit entries persist across restarts, JSON output includes metadata,
node operations emit audit records. All tests pass with -race.

---ci---
project: orca
phase: 4
milestone: v0.1
status: execute
req_covered:
  - REQ-005
  - REQ-006
  - REQ-008
  - REQ-017
  - REQ-018
---/ci---

internal/cli/audit.go

@@ -0,0 +1,60 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"git.cloudinit.dev/coreci/orca/internal/store"
+)
+
+var (
+	auditLimit int
+)
+
+var auditCmd = &cobra.Command{
+	Use:   "audit",
+	Short: "View orca audit log",
+	Long:  "Display the most recent audit log entries (security-first observability).",
+}
+
+var auditListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List recent audit log entries",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
+		defer cancel()
+
+		db, closer, err := openDB()
+		if err != nil {
+			return err
+		}
+		defer closer()
+
+		entries, err := store.NewAuditRepo(db).List(ctx, auditLimit)
+		if err != nil {
+			return err
+		}
+		if jsonOutput {
+			return printJSON(entries)
+		}
+		if len(entries) == 0 {
+			fmt.Fprintln(cmd.OutOrStdout(), "No audit entries.")
+			return nil
+		}
+		fmt.Fprintf(cmd.OutOrStdout(), "%-22s  %-12s  %-20s  %-30s  %-10s\n", "TIMESTAMP", "ACTOR", "ACTION", "RESOURCE", "RESULT")
+		for _, e := range entries {
+			fmt.Fprintf(cmd.OutOrStdout(), "%-22s  %-12s  %-20s  %-30s  %-10s\n",
+				e.Timestamp.Format("2006-01-02T15:04:05Z"), e.Actor, e.Action, e.Resource, e.Result)
+		}
+		return nil
+	},
+}
+
+func init() {
+	auditListCmd.Flags().IntVar(&auditLimit, "limit", 50, "max entries to show")
+	auditCmd.AddCommand(auditListCmd)
+	rootCmd.AddCommand(auditCmd)
+}

internal/cli/node.go

@@ -43,7 +43,8 @@ func nodeRegistry() (*engine.NodeRegistry, func() error, error) {
 		return nil, nil, err
 	}
 	repo := store.NewNodeRepo(db)
-	return engine.NewNodeRegistry(repo, newLogger()), closer, nil
+	audit := engine.NewAudit(store.NewAuditRepo(db), newLogger())
+	return engine.NewNodeRegistry(repo, audit, newLogger()), closer, nil
 }
 
 var (