DNS audit log

Every DNS change Forge attempted — including the ones its safety checks refused. Forge can only touch <app>.forge A records it created itself.