storage: `--last 0` returns every row instead of none

`doberman log --last 0` (and `policy-history --last 0`, `tune --last 0`) prints the whole table. The CLI passes `limit=max(0, last)` through (`src/doberman/cli/main.py:1311`, `:1627`, `:1200`), and `read_decisions` builds its query with `(f" LIMIT {int(limit)}" if limit else "")` (`src/doberman/storage/log.py:287`). `limit=0` is falsy, so the `LIMIT` clause is dropped and "show me zero rows" becomes "show me everything". The signature already says what was meant: `limit: int | None = None`, where `None` means unlimited. Reproduce: seed with `doberman demo --fast --path `, then `doberman log --last 0 --path ` prints all eight rows. **What to do** 1. Make the check `if limit is not None` at `log.py:287` and the same shape in `read_decisions_since` (`:310`). Check `read_policy_changes` in the same module for the same pattern and fix it too if it has it. 2. Add a test next to the existing `read_decisions` tests: with N rows stored, `limit=0` returns `[]`, `limit=None` returns all N, `limit=1` returns one. Then one CLI-level test beside `tests/unit/test_cli_log_jsonl.py`: `log --last 0` prints no rows. 3. `pytest tests/unit -k "log or decisions"` green. One-token fix at the root, so all three callers are fixed at once. Don't patch it in the CLI instead; the storage helper is where the meaning lives.