Fix ECDH zeroization, add audit logging, and remediate high findings

- Fix #61: handleRotateKey and handleDeleteUser now zeroize stored
  privBytes instead of calling Bytes() (which returns a copy). New
  state populates privBytes; old references nil'd for GC.
- Add audit logging subsystem (internal/audit) with structured event
  recording for cryptographic operations.
- Add audit log engine spec (engines/auditlog.md).
- Add ValidateName checks across all engines for path traversal (#48).
- Update AUDIT.md: all High findings resolved (0 open).
- Add REMEDIATION.md with detailed remediation tracking.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/grpcserver/server.go

@@ -13,6 +13,7 @@ import (
 
 	pb "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v2"
 	internacme "git.wntrmute.dev/kyle/metacrypt/internal/acme"
+	"git.wntrmute.dev/kyle/metacrypt/internal/audit"
 	"git.wntrmute.dev/kyle/metacrypt/internal/auth"
 	"git.wntrmute.dev/kyle/metacrypt/internal/config"
 	"git.wntrmute.dev/kyle/metacrypt/internal/engine"
@@ -27,6 +28,7 @@ type GRPCServer struct {
 	auth         *auth.Authenticator
 	policy       *policy.Engine
 	engines      *engine.Registry
+	audit        *audit.Logger
 	logger       *slog.Logger
 	srv          *grpc.Server
 	acmeHandlers map[string]*internacme.Handler
@@ -35,13 +37,14 @@ type GRPCServer struct {
 
 // New creates a new GRPCServer.
 func New(cfg *config.Config, sealMgr *seal.Manager, authenticator *auth.Authenticator,
-	policyEngine *policy.Engine, engineRegistry *engine.Registry, logger *slog.Logger) *GRPCServer {
+	policyEngine *policy.Engine, engineRegistry *engine.Registry, auditLog *audit.Logger, logger *slog.Logger) *GRPCServer {
 	return &GRPCServer{
 		cfg:          cfg,
 		sealMgr:      sealMgr,
 		auth:         authenticator,
 		policy:       policyEngine,
 		engines:      engineRegistry,
+		audit:        auditLog,
 		logger:       logger,
 		acmeHandlers: make(map[string]*internacme.Handler),
 	}
@@ -68,6 +71,7 @@ func (s *GRPCServer) Start() error {
 		sealInterceptor(s.sealMgr, s.logger, sealRequiredMethods()),
 		authInterceptor(s.auth, s.logger, authRequiredMethods()),
 		adminInterceptor(s.logger, adminRequiredMethods()),
+		auditInterceptor(s.audit),
 	)
 
 	s.srv = grpc.NewServer(