feat(session): add append-only audit log

Every SessionManager.save() now also appends the full session state
to a parallel audit file (*.audit.YYYY-MM.jsonl). This survives
session trims and memory consolidation — when something wipes the
session, the audit file retains the complete history.

Rotated monthly by filename. Never truncated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

nanobot/session/manager.py

@@ -187,6 +187,25 @@ class SessionManager:
                 f.write(json.dumps(msg, ensure_ascii=False) + "\n")
 
         self._cache[session.key] = session
+        self._append_audit(session)
+
+    def _append_audit(self, session: Session) -> None:
+        """Append session state to an audit log (append-only, rotated monthly)."""
+        now = datetime.now()
+        safe_key = safe_filename(session.key.replace(":", "_"))
+        audit_path = self.sessions_dir / f"{safe_key}.audit.{now:%Y-%m}.jsonl"
+        try:
+            with open(audit_path, "a", encoding="utf-8") as f:
+                marker = {
+                    "_type": "save_marker",
+                    "timestamp": now.isoformat(),
+                    "message_count": len(session.messages),
+                }
+                f.write(json.dumps(marker, ensure_ascii=False) + "\n")
+                for msg in session.messages:
+                    f.write(json.dumps(msg, ensure_ascii=False) + "\n")
+        except Exception as e:
+            logger.warning("Audit log write failed for {}: {}", session.key, e)
     
     def invalidate(self, key: str) -> None:
         """Remove a session from the in-memory cache."""