Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Model