feat: tamper-evident audit ledger (hash chain) + dual-column cost view

- Hash-chain ledger (cloud/ledger.py): prev_hash/entry_hash per record,
  SQLite append-only triggers, UNIQUE prev/entry hash with fail-closed
  retry at the transaction boundary; verify/export (incl. expected-head
  check for tail truncation); legacy audit_log rows marked pre-chain via
  a single ledger_genesis marker, never rewritten.
- AuthStore.audit() writes audit_log + chain entry in one transaction.
- Track-3 interface: audit_verdict / audit_pushback_round /
  audit_rebuild / third-failure assessment / test-change audit /
  meta-review / rebuild-notice entries; per-(module, contract-version)
  failure counts derived from the ledger (pass or completed rebuild
  resets; total > 3 triggers rebuild); acceptance-triggered rebuilds
  require a confirmed user notice.
- Admin read-only endpoints: GET /admin/audit-ledger/verify|export.
- Cost: dual_column_view (priced_usd_micros + billing note, wording
  reused verbatim from PR #212) wired into project/task cost endpoints;
  by-model and per-creator reporting stay in #212, not duplicated here.
- PG schema + migration lists updated for audit_ledger (incl. sequence
  setval alignment).

cloud/auth.py

@@ -24,6 +24,8 @@ approve_merge -> maintainer，manage_project -> owner（仅 owner）。
 import hashlib
 import secrets
 from cloud.db import connect as _db_connect
+from cloud.ledger import append_entry as _ledger_append
+from cloud.ledger import ensure_schema as _ledger_ensure
 import time
 import uuid
 
@@ -68,6 +70,9 @@ class AuthStore:
             "detail TEXT, "
             "created_at REAL)"
         )
+        # 防篡改账本（哈希链）：audit_log 本身不动，链写进
+        # audit_ledger；建表失败即建库失败，不静默丢链。
+        _ledger_ensure(self.conn)
         self.conn.commit()
 
     def create_user(self, username):
@@ -349,13 +354,38 @@ class AuthStore:
             )
 
     def audit(self, user_id, project_id, action, detail=""):
-        """只追加一条审计记录。"""
-        self.conn.execute(
-            "INSERT INTO audit_log(user_id, project_id, action, detail, created_at)"
-            " VALUES(?, ?, ?, ?, ?)",
-            (user_id, project_id, action, detail, time.time()),
-        )
-        self.conn.commit()
+        """只追加一条审计记录，并同步写哈希链（同事务）。
+
+        audit_log 行与 audit_ledger 链条目同 created_at、同事务
+        提交：链写失败时整对回滚并抛错（fail-closed，绝不留
+        “audit_log 有行、链上无行”的静默缺口）。并发抢链头
+        导致唯一冲突时在事务边界重试整对写入，最多 5 次；
+        其它错误直接回滚抛错，不重试。
+        """
+        now = time.time()
+        last_exc = None
+        for _attempt in range(5):
+            try:
+                self.conn.execute(
+                    "INSERT INTO audit_log(user_id, project_id, action,"
+                    " detail, created_at)"
+                    " VALUES(?, ?, ?, ?, ?)",
+                    (user_id, project_id, action, detail, now),
+                )
+                _ledger_append(self.conn, user_id, project_id, action,
+                               detail=detail, created_at=now)
+                self.conn.commit()
+                return
+            except Exception as exc:
+                last_exc = exc
+                try:
+                    self.conn.rollback()
+                except Exception:
+                    pass
+                if not isinstance(exc, sqlite3.IntegrityError) \
+                        and type(exc).__name__ != "PostgresIntegrityError":
+                    raise
+        raise last_exc
 
     def list_audit(self, project_id, limit=100):
         """按 created_at 倒序返回该项目的审计列表（dict）。"""