security(mainnet): auditor key custody hardening + on-chain rotation runbook

[akash-mondal]

Tracker: #154

Context

The mainnet auditor account 0x5ba6F05b245C06c3a4C05e7bC4486dE3661393ea is set on-chain via setAuditorPublicKey, which enables private ops (they fail closed until it is set). But its BabyJubJub private half currently lives as a local operator secret (contracts/.auditor-key.local.json, gitignored), and the auditor is an operator-controlled key rather than an independent custodian (README.md "What is Real vs. Simulated" + go/no-go). BenzoNet's manifest carries the same custody note ("until M3 sealed storage imports it").

Scope

• Move the auditor private half out of .auditor-key.local.json into the APP_MASTER_KEY-sealed prod store, with a documented import + access model.
• Write the on-chain rotation runbook: generate a new auditor keypair, setAuditorPublicKey (owner-gated), rotate downstream auditor decryption, and the operational cadence/triggers. (The console rotation UI is Console Auditor surface: compliance ledger, key rotation ceremony, public-vs-auditor view #56; this issue is the mainnet key-custody + protocol runbook.)
• Define who may trigger rotation once admin custody moves to a multisig/owner, and how audit-packet decryption continues across a rotation.

Acceptance criteria

• Auditor private key is no longer a bare local file for prod; sealed-storage import path documented + verified.
• A written setAuditorPublicKey rotation runbook (mainnet + BenzoNet) including downstream decryption impact.
• Rotation authority aligned with the new Ownable custody.

Dependencies

• Coupled with the Ownable admin-custody transfer (setAuditorPublicKey is owner-gated).