B1: keep usage counts, consent-link state and the audit log outside the container #50

Part of #46. Owner decision 2026-10-14 (via Jarvis, recorded on #46): per-person keyrings run on Cloudflare Containers (B1): keyring's Go binary unchanged, one container per person, controlled by one Durable Object (DO) per person. File mode for the owner's Mac stays the default and unchanged; everything here is opt-in. No Cloudflare account changes or spending without the owner's approval.

Depends on #45 (instance mode: encrypted state, admin API).

Problem

Today daily-limit counts and open consent links (#44) live in memory, and the audit log is a file. In a container that sleeps after 10 minutes, the counts reset (daily limits stop working), open links die, and the audit log is lost.

Change

• Daily counts: part of the state the DO keeps (or the DO enforces them), so a sleep or restart does not reset a limit.
• Consent links and sign-ins in progress: kept in the DO, or the container kept awake while a link is open (sleepAfter longer than the link lifetime). Pick one and say why.
• Audit: written to stdout (Workers logs) or posted to the DO, one JSON line per event, never a key value, as today.

Acceptance

• A daily limit still holds after the instance restarts in the middle of the day (test).
• A link created before a restart either still works or is refused cleanly; never half-works.
• Audit lines survive the container being stopped.