[Future] Immutable audit logs with hash chain

[Raulgooo]

Future

Objective

Append-only audit logs with cryptographic integrity.

Problem

• audit_logs is mutable
• DeleteAuditLogsBefore() allows hard deletion
• No hash chain

Fix

1. previous_hash column
2. SHA-256 hash per row
3. DB trigger blocks DELETE
4. immutable=true config

Files

• internal/storage/sqlite.go
• internal/audit/

Acceptance Criteria

• Hash chain
• DELETE blocked
• Separate retention policies
• Compliance ready