Audit log

Append-only record of every state change, proposal, approval, execution, and external push. Filterable by subject (order, invoice, payment, account, connection) and actor. Every entry carries who, what, when, provenance, approver, assurance level, and outcome.

Full implementation reads from the audit_log table via Supabase RLS. Deferred to the database + API integration phase.