Fix ECDH zeroization, add audit logging, and remediate high findings

- Fix #61: handleRotateKey and handleDeleteUser now zeroize stored
  privBytes instead of calling Bytes() (which returns a copy). New
  state populates privBytes; old references nil'd for GC.
- Add audit logging subsystem (internal/audit) with structured event
  recording for cryptographic operations.
- Add audit log engine spec (engines/auditlog.md).
- Add ValidateName checks across all engines for path traversal (#48).
- Update AUDIT.md: all High findings resolved (0 open).
- Add REMEDIATION.md with detailed remediation tracking.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/grpcserver/grpcserver_test.go

@@ -71,7 +71,7 @@ func newTestGRPCServer(t *testing.T) (*GRPCServer, func()) {
 		t.Fatalf("migrate: %v", err)
 	}
 	b := barrier.NewAESGCMBarrier(database)
-	sealMgr := seal.NewManager(database, b, slog.Default())
+	sealMgr := seal.NewManager(database, b, nil, slog.Default())
 	policyEngine := policy.NewEngine(b)
 	reg := newTestRegistry()
 	authenticator := auth.NewAuthenticator(nil, slog.Default())
@@ -82,7 +82,7 @@ func newTestGRPCServer(t *testing.T) (*GRPCServer, func()) {
 			Argon2Threads: 1,
 		},
 	}
-	srv := New(cfg, sealMgr, authenticator, policyEngine, reg, slog.Default())
+	srv := New(cfg, sealMgr, authenticator, policyEngine, reg, nil, slog.Default())
 	return srv, func() { _ = database.Close() }
 }