feat(audit): add pricing signature guards and reporting

Add snapshot, signature, and drift guard support for Vertex AI, Cloudflare Workers AI, and Perplexity API, backed by a queryable audit table and recent-window view.

This commit also wires the audit query layer into daily signal materialization and report generation so structure drift becomes a first-class signal instead of a log-only artifact.

scripts/perplexity_pricing_snapshot_test.go

@@ -0,0 +1,92 @@
+//go:build llm_script
+
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestBuildPerplexityPricingStructureSignatureCapturesShape(t *testing.T) {
+	raw := `
+# Models
+
+| Model | Input Price | Output Price | Documentation |
+| --- | --- | --- | --- |
+| sonar | $1.00 / 1M tokens | $5.00 / 1M tokens | [Docs](https://example.com) |
+`
+
+	signature := buildPerplexityPricingStructureSignature(raw)
+	if signature.ByteSize == 0 {
+		t.Fatalf("期望 byte_size 非 0")
+	}
+	if signature.SHA256 == "" || signature.StructureSHA256 == "" {
+		t.Fatalf("期望生成 sha256 签名: %+v", signature)
+	}
+	if len(signature.Headings) == 0 || signature.Headings[0] != "Models" {
+		t.Fatalf("标题提取错误: %+v", signature.Headings)
+	}
+	if len(signature.TableHeaders) == 0 || !strings.Contains(signature.TableHeaders[0], "Input Price") {
+		t.Fatalf("表头提取错误: %+v", signature.TableHeaders)
+	}
+	for _, key := range []string{"model_column", "input_price_column", "output_price_column", "documentation_column"} {
+		if !signature.Contains[key] {
+			t.Fatalf("期望识别 %s: %+v", key, signature.Contains)
+		}
+	}
+}
+
+func TestRunPerplexityPricingImportSnapshotOnlyWritesArtifacts(t *testing.T) {
+	tempDir := t.TempDir()
+	snapshotPath := filepath.Join(tempDir, "perplexity-live.md")
+	signaturePath := filepath.Join(tempDir, "perplexity-live.signature.json")
+
+	var out bytes.Buffer
+	err := runPerplexityPricingImport(perplexityPricingImportConfig{
+		URL:          defaultPerplexityPricingFetchURL,
+		Fixture:      filepath.Join("testdata", "perplexity_pricing_sample.md"),
+		DryRun:       true,
+		SnapshotOnly: true,
+		SnapshotOut:  snapshotPath,
+		SignatureOut: signaturePath,
+	}, nil, &out)
+	if err != nil {
+		t.Fatalf("runPerplexityPricingImport 返回错误: %v", err)
+	}
+
+	snapshotBytes, err := os.ReadFile(snapshotPath)
+	if err != nil {
+		t.Fatalf("读取 snapshot 失败: %v", err)
+	}
+	if !strings.Contains(string(snapshotBytes), "Input Price") {
+		t.Fatalf("snapshot 内容错误")
+	}
+
+	signatureBytes, err := os.ReadFile(signaturePath)
+	if err != nil {
+		t.Fatalf("读取 signature 失败: %v", err)
+	}
+	var signature markdownPricingStructureSignature
+	if err := json.Unmarshal(signatureBytes, &signature); err != nil {
+		t.Fatalf("signature JSON 解析失败: %v", err)
+	}
+	if !signature.Contains["documentation_column"] {
+		t.Fatalf("期望 signature 含 documentation_column: %+v", signature.Contains)
+	}
+
+	output := out.String()
+	for _, want := range []string{
+		"source=perplexity-pricing-snapshot",
+		"snapshot_only=true",
+		"signature_out=" + signaturePath,
+		"snapshot_out=" + snapshotPath,
+	} {
+		if !strings.Contains(output, want) {
+			t.Fatalf("输出缺少 %q，实际: %q", want, output)
+		}
+	}
+}