feat(canopy-security): implement FTI audit hash-chain integrity (plan fti-audit-hash-chain-test)

The fti-audit-hash-chain-test.adoc plan specifies Pub 1075 §9-grade hash-chain integrity for FTI audit logs. Nothing has been implemented yet. Today, fti_audit_log rows are append-only text with no cryptographic linkage — a single tampered row can't be detected.

Implementation checklist (from the plan):

  • Add previous_hash + event_hash columns to fti_audit_log and any equivalent per-service tables. Migration is additive.
  • Make PostgresFtiAuditLogger write the chain — compute event_hash = sha256(previous_hash || canonical_row_bytes) at insert time and persist.
  • Shared canopy_common::fti_audit::verify_fti_chain helper matching the existing verify_chain for audit_events.
  • Scheduled daily verification job in canopy-security/src/jobs/fti_chain_verify.rs that walks the chain and alerts on break.
  • GET /v1/security/fti/chain-status auditor endpoint exposing last-verified timestamp + any breaks found.
  • Archive chaining — fti_audit_log_archive (parallel to audit_events_archive) needs the same columns + an archive-chain verify helper.
  • ADR-004 amendment explicitly mandating FTI hash-chain integrity + the Pub 1075 §9 breach-reporting pathway. Current ADR-004 is silent on this.

Extracted from fti-audit-hash-chain-test.adoc (full plan is unimplemented).