feat: tamper-evident audit ledger (hash chain) + dual-column cost view

- Hash-chain ledger (cloud/ledger.py): prev_hash/entry_hash per record,
  SQLite append-only triggers, UNIQUE prev/entry hash with fail-closed
  retry at the transaction boundary; verify/export (incl. expected-head
  check for tail truncation); legacy audit_log rows marked pre-chain via
  a single ledger_genesis marker, never rewritten.
- AuthStore.audit() writes audit_log + chain entry in one transaction.
- Track-3 interface: audit_verdict / audit_pushback_round /
  audit_rebuild / third-failure assessment / test-change audit /
  meta-review / rebuild-notice entries; per-(module, contract-version)
  failure counts derived from the ledger (pass or completed rebuild
  resets; total > 3 triggers rebuild); acceptance-triggered rebuilds
  require a confirmed user notice.
- Admin read-only endpoints: GET /admin/audit-ledger/verify|export.
- Cost: dual_column_view (priced_usd_micros + billing note, wording
  reused verbatim from PR #212) wired into project/task cost endpoints;
  by-model and per-creator reporting stay in #212, not duplicated here.
- PG schema + migration lists updated for audit_ledger (incl. sequence
  setval alignment).

cloud/db.py

@@ -426,7 +426,8 @@ _OR_REPLACE_PK = {
 }
 
 _IDENTITY_TABLES = frozenset(
-    {"summaries", "kb_docs", "cost_records", "audit_log"})
+    {"summaries", "kb_docs", "cost_records", "audit_log",
+     "audit_ledger"})
 
 _OR_REPLACE_RE = _re.compile(
     r"^\s*INSERT\s+OR\s+REPLACE\s+INTO\s+(\w+)\s*\(([^)]+)\)\s*"
@@ -804,6 +805,19 @@ POSTGRES_SCHEMA = (
     "action TEXT, "
     "detail TEXT, "
     "created_at DOUBLE PRECISION)",
+    # 防篡改账本（哈希链，第 4 轨）：与 cloud/ledger.py 的 SQLite
+    # DDL 同表同列；prev/entry_hash UNIQUE 是并发抢链头的
+    # fail-closed 基础，绝不能去掉。
+    "CREATE TABLE IF NOT EXISTS audit_ledger("
+    "id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, "
+    "user_id TEXT, "
+    "project_id TEXT, "
+    "task_id TEXT, "
+    "action TEXT, "
+    "detail TEXT, "
+    "created_at DOUBLE PRECISION, "
+    "prev_hash TEXT NOT NULL UNIQUE, "
+    "entry_hash TEXT NOT NULL UNIQUE)",
     # P0 三件：断点与步骤事实源（PG 新库一次建齐；老库走
     # server/worker 的 ensure 幂等补表，不丢数据）。
     # task_checkpoints：每轮断点快照（worker 镜像线程 + 终局