feat(audit): let an operator read and verify the node audit log #298

Summary

The node writes a hash-chained audit log to its encrypted state partition, but an operator can't read it or verify it: there's no node RPC and no cryptosctl command for either. internal/audit has VerifyChain, and its package docs defer retrieval to a later phase.

Add both:

1. Read: a node RPC in CryptOS-PKI/api that lists audit entries (paged; filter by time range, event type and actor), and cryptosctl audit list with human, -o json and -o yaml output.
2. Verify: a node RPC that runs VerifyChain over the stored log and returns the entry count, whether the chain is intact, and the first broken sequence number if not, plus cryptosctl audit verify, which exits non-zero on a broken chain.

This blocks the v0.1.0 validation of "every action appears in the audit log".

Acceptance criteria

• The API adds the list and verify RPCs, additive, with doc comments. They use the node's existing authorization (the local socket, or the pinned admin certificate over mTLS, as for ListIssued). Operators read the log through the Fleet Manager or with cryptosctl on the node console; the node has no separate operator tier.
• cryptosctl audit list shows ceremony, issuance, revocation, config apply, escrow and reboot events, with actor and time.
• cryptosctl audit verify reports an intact chain, and detects a tampered entry at the right sequence number.
• Tests come first for both: paging and filters; an intact chain; a tampered entry.
• Docs describe both commands.

Notes

Related: #15 (the hash-chained audit log).