fix(audit): keep refusals and job telemetry out of audit_logs

A *.validation-failed row was written on every malformed request, the
caller's own included, and the PR detection enqueue wrote one per batch.
Neither is a security event and nothing reads them. auditLog now files a
refused attempt only when a delegate made it, for the owner's activity
feed; otherwise it rides the wide event as meta.rejected_attempt. The PR
detection enqueue moves to annotate().

src/app/api/measurements/batch/__tests__/duplicate-prefilter.test.ts

@@ -493,13 +493,14 @@ describe("a batch of duplicates only (v1.42)", () => {
     await post([weight("uuid-new", new Date(NOW - DAY))]);
     expect(enqueuePrDetection).toHaveBeenCalledTimes(1);
     expect(enqueueReminderSatisfy).toHaveBeenCalledTimes(1);
+    // The enqueue is telemetry on the wide event, never an audit row.
     expect(
       vi
         .mocked(auditLog)
         .mock.calls.some(
           ([action]) => action === "personal_records.detection_enqueued",
         ),
-    ).toBe(true);
+    ).toBe(false);
   });
 });
 

src/app/api/measurements/batch/route.ts

@@ -1302,13 +1302,9 @@ async function postBatch(request: NextRequest): Promise<Response> {
     });
     try {
       await enqueuePrDetection(user.id, { silent });
-      await auditLog("personal_records.detection_enqueued", {
-        userId: user.id,
-        details: {
-          source: "measurement.batch",
-          batchSize: entries.length,
-          silent,
-        },
+      // Telemetry, not an audit event: it rides the wide event.
+      annotate({
+        meta: { pr_detection_enqueued: true, pr_detection_silent: silent },
       });
     } catch (err) {
       // Enqueue failure is non-fatal — the 30-minute fallback cron

src/app/api/workouts/batch/route.ts

@@ -893,13 +893,9 @@ async function postBatch(request: NextRequest): Promise<Response> {
     const silent = workouts.length > PR_DETECTION_SILENT_THRESHOLD;
     try {
       await enqueuePrDetection(user.id, { silent });
-      await auditLog("personal_records.detection_enqueued", {
-        userId: user.id,
-        details: {
-          source: "workout.batch",
-          batchSize: workouts.length,
-          silent,
-        },
+      // Telemetry, not an audit event: it rides the wide event.
+      annotate({
+        meta: { pr_detection_enqueued: true, pr_detection_silent: silent },
       });
     } catch (err) {
       annotate({