Add packaged DLP broker and protected Windows service foundation

tests/fixtures/broker-durable-audit.cjs

@@ -0,0 +1,17 @@
+'use strict';
+// Test-only, actual fsync of synthetic metadata. Production uses the protected
+// encrypted audit store; this fixture never stores request contents or tokens.
+const fs=require('node:fs');
+const path=require('node:path');
+const {randomUUID}=require('node:crypto');
+const {BrokerAuditEventSchema}=require('../../apps/network-broker/audit-gate.cjs');
+function createSyntheticAudit(test){
+  const root=path.resolve(__dirname,'../../artifacts/broker-audit-fixtures');fs.mkdirSync(root,{recursive:true});
+  const filename=path.join(root,`${randomUUID()}.jsonl`),fd=fs.openSync(filename,'wx');
+  test.after(()=>fs.closeSync(fd));
+  return Object.freeze({
+    persist:event=>{BrokerAuditEventSchema.parse(event);fs.writeFileSync(fd,JSON.stringify(event)+'\n');fs.fsyncSync(fd);return {persisted:true,eventId:event.eventId};},
+    events:()=>fs.readFileSync(filename,'utf8').trim().split('\n').filter(Boolean).map(line=>JSON.parse(line))
+  });
+}
+module.exports={createSyntheticAudit};