feat(cli): add local audit trail

[jamiesun]

Summary

• add default local JSONL audit events at ~/.sshx/audit/sshx-YYYY-MM-DD.jsonl
• add --audit-output=<dir>, --no-audit, SSHX_AUDIT_OUTPUT, and SSHX_NO_AUDIT
• record operation metadata and outcomes without stdout/stderr, plaintext passwords, or private key contents
• redact common password/token-style values in command text and error messages
• keep --dry-run side-effect-free by skipping audit writes

Verification

• go test ./...
• make check
• manual blocked-command audit smoke test with --audit-output=/tmp/sshx-audit-codex-12b

Fixes #12