The terminal lists who can do what in each app, read from its contract.json, as /audit and MCP `audit` do #7935

Intent: plain about who can see what, in the terminal too.

Today /audit (src/web/pages/audit.ts) and MCP audit both read audit() from src/contract/audit.ts; the terminal has no such screen.

Done:

• [ ] A new screen src/tui/screens/audit.ts, offered in the palette as "Who can do what" through src/tui/screens/entries.ts: one row per app the viewer can read, each door with yes, own or no, whether outsiders may direct its crew, and an app without a sound contract.json listed as "unread" (never hidden), as the page does.
• [ ] It reads through the same audit() and the same visibility (listReposVisibleTo) as the page; nothing about a repository the viewer cannot read.
• [ ] Enter on a row opens that app's repository screen, as other lists do.
• [ ] A test (test/tui-audit.test.ts) fails without the change: a reader sees their app's doors; a stranger sees only public apps; an app with no contract reads "unread".

Files: src/tui/screens/audit.ts, src/tui/screens/entries.ts, test/tui-audit.test.ts. Risks: entries.ts is a one-line-per-screen list; add one line in its order.