feat: 添加结构化日志与审计

- tracing + tracing-subscriber，全局 --verbose/-v 与 RUST_LOG 控制
- 新增 audit_log 表，add/update/delete 成功后自动写入审计记录
- 新增 src/audit.rs，审计失败仅 warn 不中断主流程
- 更新 README/AGENTS.md，补充 verbose、audit_log 说明
- .vscode/tasks.json 增加 verbose/update/audit 测试任务

Made-with: Cursor

src/main.rs

@@ -1,3 +1,4 @@
+mod audit;
 mod commands;
 mod config;
 mod db;
@@ -5,6 +6,7 @@ mod models;
 
 use anyhow::Result;
 use clap::{Parser, Subcommand};
+use tracing_subscriber::EnvFilter;
 
 #[derive(Parser)]
 #[command(
@@ -17,6 +19,10 @@ struct Cli {
     #[arg(long, global = true, default_value = "")]
     db_url: String,
 
+    /// Enable verbose debug output
+    #[arg(long, short, global = true)]
+    verbose: bool,
+
     #[command(subcommand)]
     command: Commands,
 }
@@ -132,6 +138,16 @@ enum ConfigAction {
 async fn main() -> Result<()> {
     let cli = Cli::parse();
 
+    let filter = if cli.verbose {
+        EnvFilter::new("secrets=debug")
+    } else {
+        EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new("secrets=warn"))
+    };
+    tracing_subscriber::fmt()
+        .with_env_filter(filter)
+        .with_target(false)
+        .init();
+
     // config 子命令不需要数据库连接，提前处理
     if let Commands::Config { action } = &cli.command {
         let cmd_action = match action {
@@ -157,6 +173,8 @@ async fn main() -> Result<()> {
             meta,
             secrets,
         } => {
+            let _span =
+                tracing::info_span!("cmd", command = "add", %namespace, %kind, %name).entered();
             commands::add::run(&pool, namespace, kind, name, tags, meta, secrets).await?;
         }
         Commands::Search {
@@ -166,6 +184,7 @@ async fn main() -> Result<()> {
             query,
             show_secrets,
         } => {
+            let _span = tracing::info_span!("cmd", command = "search").entered();
             commands::search::run(
                 &pool,
                 namespace.as_deref(),
@@ -181,6 +200,8 @@ async fn main() -> Result<()> {
             kind,
             name,
         } => {
+            let _span =
+                tracing::info_span!("cmd", command = "delete", %namespace, %kind, %name).entered();
             commands::delete::run(&pool, namespace, kind, name).await?;
         }
         Commands::Update {
@@ -194,6 +215,8 @@ async fn main() -> Result<()> {
             secrets,
             remove_secrets,
         } => {
+            let _span =
+                tracing::info_span!("cmd", command = "update", %namespace, %kind, %name).entered();
             commands::update::run(
                 &pool,
                 commands::update::UpdateArgs {