feat: tamper-evident audit ledger (hash chain) + dual-column cost view

- Hash-chain ledger (cloud/ledger.py): prev_hash/entry_hash per record,
  SQLite append-only triggers, UNIQUE prev/entry hash with fail-closed
  retry at the transaction boundary; verify/export (incl. expected-head
  check for tail truncation); legacy audit_log rows marked pre-chain via
  a single ledger_genesis marker, never rewritten.
- AuthStore.audit() writes audit_log + chain entry in one transaction.
- Track-3 interface: audit_verdict / audit_pushback_round /
  audit_rebuild / third-failure assessment / test-change audit /
  meta-review / rebuild-notice entries; per-(module, contract-version)
  failure counts derived from the ledger (pass or completed rebuild
  resets; total > 3 triggers rebuild); acceptance-triggered rebuilds
  require a confirmed user notice.
- Admin read-only endpoints: GET /admin/audit-ledger/verify|export.
- Cost: dual_column_view (priced_usd_micros + billing note, wording
  reused verbatim from PR #212) wired into project/task cost endpoints;
  by-model and per-creator reporting stay in #212, not duplicated here.
- PG schema + migration lists updated for audit_ledger (incl. sequence
  setval alignment).

cloud/migrations.py

@@ -46,6 +46,9 @@ MIGRATION_TABLES = (
     "project_members",
     "tasks",
     "audit_log",
+    # 防篡改账本（哈希链，第 4 轨）：与 audit_log 同款身份列，
+    # 迁库时整行原样迁（id 与哈希不动，链不断），序列见下。
+    "audit_ledger",
     "summaries",
     "kb_docs",
     "cost_records",
@@ -91,12 +94,13 @@ MIGRATION_TABLES = (
 _SKIP_TABLES = frozenset({"kb_fts", "sqlite_sequence"})
 
 # 身份列的表：POSTGRES_SCHEMA 里唯一用
-# ``BIGINT GENERATED BY DEFAULT AS IDENTITY`` 的 4 张表。
+# ``BIGINT GENERATED BY DEFAULT AS IDENTITY`` 的 5 张表。
 # 迁移时显式插 id 不会推序列，迁完必须 setval 到 MAX(id)，
 # 否则后续省略 id 的 INSERT 会撞主键。新增身份列表必须
 # 同步改这里，test_p2_migrations.py 会拿 schema 实测对齐。
 SEQUENCE_TABLES = (
     "audit_log",
+    "audit_ledger",
     "summaries",
     "kb_docs",
     "cost_records",