docs(audit): say why two import refusals stay audit rows

The export imports log a refused upload as a signal. The admin import
and the medication intake import kickoff keep audit rows on purpose:
one is an administrator acting on another account, the other is shown
to the record's owner in the activity feed.

src/app/api/admin/import-apple-health-export/route.ts

@@ -55,6 +55,10 @@ export const POST = apiHandler(async (request: NextRequest) => {
     throw new HttpError(429, "Too many import uploads, try again later");
   }
 
+  // A refused upload is an audit row here, not the signal the user-facing
+  // import routes emit for the same refusals: this is an administrator
+  // acting on another person's account, and every attempt at that, refused
+  // ones included, belongs in the trail an operator reviews.
   const declaredBytes = Number(request.headers.get("content-length") ?? 0);
   if (declaredBytes > MAX_UPLOAD_BYTES) {
     await auditLog("admin.import-apple-health.kickoff.denied", {

src/lib/medications/intake-import-admission.ts

@@ -171,6 +171,10 @@ export async function admitIntakeImportJob({
         completedAt,
       },
     });
+    // An audit row, unlike the upload refusals of the export imports, which
+    // are signals: this one is shown to the record's owner in the activity
+    // feed (`record-activity/activity-verb.ts`) as an import that was
+    // admitted and never ran, and it carries the delegate who started it.
     await auditLog("medication.intake.import.kickoff.denied", {
       userId: recordUserId,
       actorUserId,