fix(api): meter every authenticated write where the caller is resolved

169 of 364 mutating handlers met no rate limit, every PATCH and DELETE on
an [id] among them. The shared per-account write bucket (300 a minute,
keyed on the acting account) was called by hand in a dozen creates; it is
now charged by the identity resolvers for any POST, PUT, PATCH or DELETE,
once per request, so a route is metered by resolving its caller.

The bulk ingest routes the native client syncs through in bursts
(measurements, workouts, intake, mood and cycle bulk, nutrients, the ECG
sweep) declare writeBucket: "own" and keep their dedicated ceilings, so a
large HealthKit backfill cannot lock the person out of logging a dose. A
read-over-POST stays free.

write-rate-limit-guard fails on any mutating route that neither resolves
its caller through a metering resolver nor calls a limiter, unless it is
on a short reasoned exception list; an opt-out must be on its own reviewed
list and call its own limiter.

docs/api/openapi.yaml

@@ -396,9 +396,10 @@ paths:
         "409": *a7
         "422": *a4
         "429": &a12
-          description: "Rate limit exceeded. This route shares one per-account bucket with the other single-record writes —
+          description: "Rate limit exceeded. This route shares one per-account bucket with every other authenticated write —
             `record-write:<accountId>`, 300 requests per 60 seconds — keyed on the ACTING account, so a delegate burns
-            their own allowance rather than the record owner's. Nothing was written. `meta.errorCode` is
+            their own allowance rather than the record owner's. Only the bulk ingest endpoints, which meter themselves
+            with a dedicated bucket, stay outside it. Nothing was written. `meta.errorCode` is
             `record_write.rate_limited`, which is what tells this refusal apart from a route's own narrower bucket when
             both can answer 429. The `Retry-After`, `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`
             headers describe that bucket; back off on `Retry-After` rather than guessing. Every request counts against