Audit log — record intercepted commands with timestamp and outcome

Track every command mulonda intercepts: timestamp, full command, whether the user confirmed or aborted. Write to `~/.config/mulonda/audit.log` or a configurable path. Useful for post-incident review.