feat(data-safety): scheduled DB backups + audit trail + verified actor attribution

- db-backup sidecar: pg_dump -Fc of procurement+casdoor every
  BACKUP_INTERVAL_SECONDS into BACKUP_DIR, retention via BACKUP_KEEP_DAYS
- audit_log table (migration.sql + runtime ensure_audit_table) with
  model + transactional helper (utils/audit.record) — wired into user
  create/role-change and inventory transaction creation
- get_actor: quote_events.actor now stores the VERIFIED user's display
  name instead of the raw bearer token

backend/app/models/__init__.py

@@ -1,5 +1,6 @@
 """ORM models — import order matters only for registration in Base.metadata."""
 from app.db.base import Base
+from app.models.audit import AuditLog
 from app.models.catalog import (
     AttributeDefinition,
     Brand,