internal/audit: insertSafely now returns the actual error (including a
recovered panic) instead of a bare bool. Each failed insert logs
immediately via slog.Warn with the real driver error and request_id, and
the last error is kept on Queue and surfaced through Stats.LastError, so
it shows up in the existing periodic "audit counters" log line too.
Previously a broken DB only ever produced dropped/failed counts with no
indication of why.

internal/api: check() now logs one "ocsp check" line per request (level
Warn for 5xx) with request_id, appname, verstion, key_id, remote_ip,
claimed_ip, provider, serial, certificate_status, http_status, error_code,
duration_ms. This runs independently of TryEnqueue/Postgres, so requests
stay visible in `docker logs` even while audit inserts are failing.
Username/MST-UID are intentionally left out of this line; that stays
exclusive to the access-controlled PostgreSQL audit trail.

Found while diagnosing a live deployment where audit counters showed
failed=5/written=0 with no way to see the underlying Postgres error from
docker logs alone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>