Phase 1: config loading, database migrations, audit log

- internal/config: TOML config with env overrides (MCR_ prefix),
  required field validation, same-filesystem check, defaults
- internal/db: SQLite via modernc.org/sqlite, WAL mode, 2 migrations
  (core registry tables + policy/audit), foreign key cascades
- internal/db: audit log write/list with filtering and pagination
- deploy/examples/mcr.toml: annotated example configuration
- .golangci.yaml: disable fieldalignment (readability over micro-opt)
- checkpoint skill copied from mcias

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/examples/mcr.toml

@@ -0,0 +1,33 @@
+# MCR — Metacircular Container Registry configuration.
+# Copy to /srv/mcr/mcr.toml and edit before running.
+
+[server]
+listen_addr      = ":8443"           # HTTPS (OCI + admin REST)
+grpc_addr        = ":9443"           # gRPC admin API (optional; omit to disable)
+tls_cert         = "/srv/mcr/certs/cert.pem"
+tls_key          = "/srv/mcr/certs/key.pem"
+read_timeout     = "30s"             # HTTP read timeout
+write_timeout    = "0s"              # 0 = disabled for large blob uploads
+idle_timeout     = "120s"            # HTTP idle timeout
+shutdown_timeout = "60s"             # Graceful shutdown drain period
+
+[database]
+path = "/srv/mcr/mcr.db"
+
+[storage]
+layers_path  = "/srv/mcr/layers"    # Blob storage root
+uploads_path = "/srv/mcr/uploads"   # Must be on the same filesystem as layers_path
+
+[mcias]
+server_url   = "https://mcias.metacircular.net:8443"
+ca_cert      = ""                   # Custom CA for MCIAS TLS (optional)
+service_name = "mcr"
+tags         = ["env:restricted"]
+
+[web]
+listen_addr = "127.0.0.1:8080"      # Web UI listen address
+grpc_addr   = "127.0.0.1:9443"      # mcrsrv gRPC address for the web UI
+ca_cert     = ""                     # CA cert for verifying mcrsrv gRPC TLS
+
+[log]
+level = "info"                       # debug, info, warn, error