fix: audit expert vault unlock failures

[luojiyin1987]

What changed

• Treat only Fernet authentication failures as invalid Expert Access Keys.
• Verify both the encrypted vault and its metadata against release-maintained SHA-256 digests before JSON parsing or PBKDF2 work.
• Configure root logging to emit INFO audit events to stderr under Gunicorn.
• Audit successful, invalid-key, and loading-error unlock outcomes without recording access keys or player names.
• Add tests for vault failures, valid metadata tampering, audit events, and secret redaction.

Why

The previous broad exception handler converted operational vault failures into an indistinguishable invalid-key response, which concealed deployment faults and left no unlock-attempt audit trail. Fernet intentionally uses InvalidToken for both wrong keys and invalid tokens, so independent integrity anchors are required to distinguish vault corruption before key derivation and decryption.

Validation

• python3 -m py_compile app.py challenges/expert_vault.py tests/test_expert_unlock.py
• pytest -q — 13 passed
• git diff --check

Closes #2