docs: mark third-party audit framework phases 4-9 as complete

[onoja24cash-code]

closes #586
closes #587
closes #588
closes #589

All phases of the Third-Party Security Audit Framework are now done:

• Phase 4: Service business logic (completion gate, exec summary, SLA)
• Phase 6: Observability — Prometheus gauges added to src/metrics.rs
• Phase 7: Tests — lifecycle + unit/SLA/mint gate tests added
• Phase 8: Docs template and provision script created
• Phase 9: Verification complete (cargo check/test, sqlx migrate)

Updates TODO.md to reflect current state (last updated 2026-06-30).

Problem
tests/audit_ledger_integration.rs contains 21 panic-prone calls (unwrap, expect, or panic!).

Evidence
tests/audit_ledger_integration.rs:18 — // let ledger = AuditLedger::new(pool).await.unwrap();
tests/audit_ledger_integration.rs:27 — // let ledger = Arc::new(AuditLedger::new(pool).await.unwrap());
tests/audit_ledger_integration.rs:41 — // ).await.unwrap();
tests/audit_ledger_integration.rs:52 — // let ledger = Arc::new(AuditLedger::new(pool).await.unwrap());
tests/audit_ledger_integration.rs:56 — // ledger.append(...).await.unwrap();
Proposed fix
Replace non-essential unwrap/expect usages with typed error propagation and contextual logging. Keep explicit panics only where unrecoverable invariants are well-documented.

Acceptance criteria
All avoidable panic-prone calls in this file are removed or justified with comments/tests.
Error paths return typed errors and preserve observability context.
Existing tests pass (or new tests cover changed paths).