feat(cli): campus audit status — show the stored audit key's binding and target #62

Context

campus auth status (#45) answers "what can this stored credential do?"
— client, endpoint, principal, scopes, expiry — plus a lightweight
server-side validity check.

The campus audit group (#55) has no equivalent. The stored audit key's
state is only visible indirectly: campus audit keys list needs
apikeys:read (which a trace-only student key does not have), and
campus audit traces list only fails when the key is actually used.

The audit service has no "who am I" endpoint, so this has to be a local
view: which URL the stored key is bound to, and when it was stored. That
is exactly the information the URL-binding check uses when it refuses a
command with "stored for X but targeting Y".

Proposed fix

Add campus audit status:

• the audit URL the stored key is bound to, and the URL the CLI currently
  targets (flagging a mismatch the way the command's own error does)
• the key's age (when it was stored)
• the local state: not logged in / key present

It stays offline (no network call), like campus auth status --offline.

Acceptance

• campus audit status reports the bound URL, the current target, and
  whether a key is stored.
• It makes no network call.
• A bound/current URL mismatch is called out the way the command
  errors do.