fix(core): preserve audit append order for timestamp ties - #2803

Code Review Summary

PR #2803 adds a database-owned append sequence to audit records, extends ordering to (created_at, append_order), and backfills legacy SQLite/PostgreSQL tables. The pagination assertions and provider-specific coverage are useful, and the append allocator avoids exposing a new public API. I assessed this as standard risk because it changes shared persistence and request-time schema behavior.

Key Findings

• 🔴 HIGH: Existing PostgreSQL deployments cannot safely adopt the new schema from the request path. The initializer now requires the new column, allocator table, trigger, and indexes, but the PR does not add an authorized release migration. In production serverless, schema mutation is disabled, so legacy installations can reject every audit read/write during initialization.
• 🟡 MEDIUM: SQLite/D1 initialization is not atomic when the client has no transaction method. Concurrent cold starts can interleave the column check, backfill, trigger, and index creation; a duplicate ALTER TABLE or partially upgraded schema can make audit operations fail, and an insert in the trigger-install window can retain a null append order.

The local SQLite audit suite passes (13 tests). PostgreSQL integration coverage is gated on a local test URL and was not available here.

🧪 Browser testing: Skipped — PR only modifies backend/database code, tests, and a changeset; no UI impact.