pub fn audit_log(action: &str, resource: &str, details: &str) -> Result<()>
Log an audit event (append-only, crash-safe).