fix: audit expert vault unlock failures

[luojiyin1987]

What changed

• Treat only Fernet authentication failures as invalid Expert Access Keys.
• Verify both the encrypted vault and its metadata against release-maintained SHA-256 digests before JSON parsing or PBKDF2 work.
• Configure root logging to emit INFO audit events to stderr under Gunicorn.
• Audit successful, invalid-key, and loading-error unlock outcomes without recording access keys or player names.
• Add tests for vault failures, valid metadata tampering, audit events, and secret redaction.

Why

The previous broad exception handler converted operational vault failures into an indistinguishable invalid-key response, which concealed deployment faults and left no unlock-attempt audit trail. Fernet intentionally uses InvalidToken for both wrong keys and invalid tokens, so independent integrity anchors are required to distinguish vault corruption before key derivation and decryption.

Validation

• python3 -m py_compile app.py challenges/expert_vault.py tests/test_expert_unlock.py
• pytest -q — 13 passed
• git diff --check

Closes #2

[CyberSunil]

Sorry for the long delay on this — thanks for the thorough writeup and for the tests, the integrity-anchor approach is the right call. You're correct that InvalidToken can't distinguish a wrong key from a corrupt vault, so checking the digests before key derivation is the only clean way to separate them.

Two things before I can merge: the branch has a conflict in app.py against current main, and the three required CI checks are blocked behind it. Could you rebase on main?

[luojiyin1987]

I fixed the code conflict.