Function append_audit 

pub fn append_audit(
    audit_log_path: Option<&Path>,
    entry: &AuditEntry<'_>,
) -> Result<()>

Append a single JSON-line audit entry. No-op when audit_log_path is None. Errors creating the parent dir or opening the file are surfaced to the caller — production paths log-and-continue so a misconfigured audit dir doesn’t block real reads.