[Security] Audit trail should verify signatures on startup

[Vitalcheffe]

Description

Currently the Ed25519 audit trail appends signed entries, but there is no automatic verification on startup. We should verify all existing signatures when the agent starts to detect any tampering.

Proposed fix

Add a verifyAll() call during nebula start initialization. If any signature fails, warn the user and log the invalid entry line numbers.

Priority

High — this is a security feature and the project is marketed as zero-trust.

[Vitalcheffe]

Great catch! This is critical for the zero-trust promise. I will add verifyAll() to the startup sequence.

The implementation plan:

1. Read audit.log line by line
2. Verify each Ed25519 signature
3. Log warning if any invalid entries found
4. Continue startup (do not block, just warn)

Target: v8.1.0