Enterprise log shipping / OpenTelemetry export for audit records

[nicknikolakakis]

Summary

Stream audit records (and anchored Merkle roots) to enterprise SIEM / OTel backends, in addition to the local hash-chained JSONL. Proposal #6 from the product roadmap.

Motivation

audit.Open writes a tamper-evident JSONL to local disk; proxy.ServeHTTP calls Log.Append per request and fails closed on write error. Enterprises need these records centralized (Datadog, Splunk, CloudWatch, Elasticsearch) for monitoring, alerting, and audit.

Proposed behavior

• Optional exporter that ships each appended audit entry to an OTel logs endpoint (OTLP) and/or a generic HTTP/syslog sink.
• The local JSONL stays authoritative; export is additive and best-effort so a remote outage never blocks requests (local append already gives durability + fail-closed).
• Export the redacted payload hash, method/path/model, PII counts, seq, and prev/cur chain hashes - never originals.

Implementation sketch

• internal/audit - add an exporter interface invoked after a successful local append (hook is the existing Append).
• cmd/sphragis/serve.go - wire the exporter from config; reuse the existing /metrics patterns for endpoint config.
• Reuse log/slog where an OTLP SDK is overkill; gate the OTLP dependency so the default binary stays lean.

Caveats

• Must preserve fail-closed semantics on the local write; remote failures are logged + counted (add a metric), not fatal.
• Keep dependencies minimal to protect the single-binary value prop; consider OTLP/HTTP JSON before pulling a heavy SDK.

Acceptance criteria

• Disabled by default; no behavior change.
• Enabled: each audit entry is delivered to the configured sink with no originals in the payload.
• Remote sink failure does not fail the request; it increments a failure metric.
• Tests with a stub sink; go test ./... -race, vet, lint clean.