feat(audit): read-only knowledge-graph drift report + skill

Adds audit_knowledge_graph (MCP tool) and GET /api/v1/audit/drift (endpoint)
backed by a shared internal/audit package. One pass surfaces the structural
gaps an operator otherwise finds by accident: orphan check entities, checks
targeting deprecated/destroyed entities, probes stuck down/unknown, unmonitored
declared types, and live edges pointing at destroyed targets. Each finding
carries a suggested remediation runbook. Read-only and safe to run unattended.

Ships the knowledge-graph-audit skill (SKILL.md + seeded runbook) that
interprets the report and routes findings to the lifecycle runbooks.

internal/httpapi/audit.go

@@ -0,0 +1,20 @@
+package httpapi
+
+import (
+	"net/http"
+
+	"github.com/dtoro/oikos/internal/audit"
+)
+
+// serveAuditDrift returns a read-only DB-side drift report: orphan check
+// entities, checks on retired targets, probes stuck down/unknown, unmonitored
+// declared types, and dangling edges. Companion to the knowledge-graph-audit
+// skill. Live-infra discovery (pct/docker/certs) is a follow-up.
+func (s *Server) serveAuditDrift(w http.ResponseWriter, req *http.Request) {
+	findings, summary := audit.Report(req.Context(), s.pool)
+	writeJSON(w, map[string]any{
+		"findings": findings,
+		"summary":  summary,
+		"note":     "read-only DB drift report; live-infra discovery (pct/docker/certs) is a follow-up",
+	})
+}