Complete Phase 1: policy kernel, REST service, and local smoke tooling

Implements QONTO-WP-0002 (policy-gated Qonto REST service with audit
logging, rate limiting, and credential handling) and the ADHOC-2026-07-21
follow-up (fixture-backed local smoke mode, repo classification metadata).
Marks QONTO-WP-0001/0002 and the ad-hoc workplan finished, and regenerates
WORK-RECORDS.md and the ADHOC workplan's state_hub_workstream_id via
fix-consistency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_audit.py

@@ -0,0 +1,25 @@
+import logging
+
+from qonto_assistant.audit import AuditLogger, REDACTED
+
+
+def test_audit_logger_redacts_secret_fields() -> None:
+    events: list[dict[str, object]] = []
+    logger = logging.getLogger("qonto_assistant.audit.test")
+    logger.handlers.clear()
+    audit = AuditLogger(logger=logger, sink=events.append)
+
+    payload = audit.emit(
+        {
+            "authorization": "Bearer super-secret",
+            "api_key": "top-secret",
+            "nested": {"token": "child-secret"},
+            "capability": "org_summary",
+        }
+    )
+
+    assert payload["authorization"] == REDACTED
+    assert payload["api_key"] == REDACTED
+    assert payload["nested"]["token"] == REDACTED
+    assert "super-secret" not in str(events[0])
+    assert "top-secret" not in str(events[0])