fix: audit FK + file logging (0.7.1)

[blackaxgit]

Summary

Two bug fixes uncovered during real-tenant smoke testing of 0.7.0.

Fix 1 — Audit log FK constraint failure on every L0-decided call

Symptom: WARN clx_hook::audit: Failed to create audit log: Storage error: FOREIGN KEY constraint failed fires every time L0 deterministic validation makes the decision (no L1 LLM call needed). The audit log table has a FK to sessions(id) but the session row doesn't exist for fast-path / synthetic IDs.

Fix: Storage::create_audit_log now does INSERT OR IGNORE INTO sessions (id, project_path, started_at, source, status) VALUES (?1, '', datetime('now'), 'audit-placeholder', 'active') before the audit insert. Idempotent — no-op when the session was already created by SessionStart.

Fix 2 — logging.file was never wired up

Symptom: Config has logging.file: ~/.clx/logs/clx.log. The ~ expansion was already implemented (Config::log_file_path()), but no code actually opened the file. Hooks logged to stderr only — and stderr is ERROR-only by design (Claude Code treats hook stderr as failure noise), so users got nothing.

Fix: clx-hook/src/main.rs now opens the configured log path on init and adds it as a second tracing-subscriber layer (WARN+). stderr stays ERROR-only. No new dep needed (small MutexFile adapter for Arc<Mutex<File>> → MakeWriter).

Verification

• cargo build/clippy/test/fmt — all clean locally.
• Smoke-tested both fixes:
  • Hook fire with synthetic session ID — no FK warning.
  • cat ~/.clx/logs/clx.log after hook fire — populated with INFO/WARN events.

Test plan

• Local gates green
• CI green
• After merge: brew upgrade clx → 0.7.1 → re-run the 0.7.0 fallback smoke test → confirm no FK warnings, log file populated