feat(P04): audit log + persistence hardening

Implements Phase 4 of v0.1 Foundation:
- internal/store/migrations/0003_audit_log.sql: audit_log table with indexes
- internal/store/audit_repo.go: AuditRepo (Append + List)
- internal/store/audit_repo_test.go: 2 tests for audit persistence
- internal/engine/audit.go: Audit wrapper that persists to SQLite AND logs via slog
- internal/cli/audit.go: orca audit list command (text + JSON)
- Registry now records every join/leave/forget with actor/action/resource/result

Verified: audit entries persist across restarts, JSON output includes metadata,
node operations emit audit records. All tests pass with -race.

---ci---
project: orca
phase: 4
milestone: v0.1
status: execute
req_covered:
  - REQ-005
  - REQ-006
  - REQ-008
  - REQ-017
  - REQ-018
---/ci---

internal/cli/node.go

@@ -43,7 +43,8 @@ func nodeRegistry() (*engine.NodeRegistry, func() error, error) {
 		return nil, nil, err
 	}
 	repo := store.NewNodeRepo(db)
-	return engine.NewNodeRegistry(repo, newLogger()), closer, nil
+	audit := engine.NewAudit(store.NewAuditRepo(db), newLogger())
+	return engine.NewNodeRegistry(repo, audit, newLogger()), closer, nil
 }
 
 var (