feat(audit): add pricing signature guards and reporting

Add snapshot, signature, and drift guard support for Vertex AI, Cloudflare Workers AI, and Perplexity API, backed by a queryable audit table and recent-window view.

This commit also wires the audit query layer into daily signal materialization and report generation so structure drift becomes a first-class signal instead of a log-only artifact.

scripts/perplexity_pricing_import_runner.go

@@ -0,0 +1,66 @@
+//go:build llm_script
+
+package main
+
+import (
+	"database/sql"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+type perplexityPricingImportConfig struct {
+	URL          string
+	Fixture      string
+	DryRun       bool
+	Timeout      time.Duration
+	SnapshotOnly bool
+	SnapshotOut  string
+	SignatureOut string
+}
+
+func runPerplexityPricingImport(cfg perplexityPricingImportConfig, db *sql.DB, out io.Writer) error {
+	client := &http.Client{Timeout: cfg.Timeout}
+	raw, err := fetchRawPricingPage(cfg.URL, cfg.Fixture, client)
+	if err != nil {
+		return err
+	}
+	if cfg.SnapshotOnly || strings.TrimSpace(cfg.SnapshotOut) != "" || strings.TrimSpace(cfg.SignatureOut) != "" {
+		snapshotPath, signaturePath := resolvePerplexityPricingSnapshotPaths(cfg.SnapshotOut, cfg.SignatureOut, "", time.Now())
+		signature, err := writePerplexityPricingSnapshotArtifacts(raw, cfg.URL, snapshotPath, signaturePath, time.Now())
+		if err != nil {
+			return err
+		}
+		if cfg.SnapshotOnly {
+			_, err = fmt.Fprintf(out,
+				"source=perplexity-pricing-snapshot snapshot_only=true byte_size=%d sha256=%s structure_sha256=%s snapshot_out=%s signature_out=%s\n",
+				signature.ByteSize, signature.SHA256, signature.StructureSHA256, snapshotPath, signaturePath,
+			)
+			return err
+		}
+	}
+	records, err := parsePerplexityPricingCatalog(raw)
+	if err != nil {
+		return err
+	}
+	records = dedupeOfficialPricingRecords(records)
+	if cfg.DryRun {
+		_, err = fmt.Fprintf(out, "source=perplexity-pricing-import models=%d operator=%s dry_run=true\n", len(records), records[0].OperatorName)
+		return err
+	}
+	if db == nil {
+		return fmt.Errorf("db is required when dry-run=false")
+	}
+	if err := upsertOfficialPricingRecords(db, records, "perplexity-pricing-import"); err != nil {
+		return err
+	}
+
+	var tableRows int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM region_pricing`).Scan(&tableRows); err != nil {
+		return fmt.Errorf("count region_pricing: %w", err)
+	}
+	_, err = fmt.Fprintf(out, "source=perplexity-pricing-import models=%d operator=%s table_rows=%d dry_run=false\n", len(records), records[0].OperatorName, tableRows)
+	return err
+}