feat(sharing): record who acted when it was not the account's owner

Adds AuditLog.actorUserId (migration 0294) and threads it centrally, out
of the wide-event context the acting-account resolver already stamps. No
call site passes an actor, so no route can forget one.

NULL keeps meaning "acted for themselves" — the reading every existing
row carries. The threading fills the column only when a request resolved
an acting account AND the row is being filed under that account, so a
self-action, a refusal, and a delegate's row about themselves all stay
NULL rather than acquiring an id that would rewrite what the history says.

Delegated reads coalesce to one row per owner, delegate and day, through
a partial unique index and an insert that expects to lose the race. The
alternative is a row per request on the busiest table in the schema and
an activity view made of identical lines.

The column carries no foreign key, against the grain of user_id beside
it: SET NULL there erases an account from its own history, while here it
would turn "the delegate opened this record" into "the owner opened this
record". An id that no longer resolves reads as a deleted account; an id
that silently became NULL reads as a lie.

src/lib/api-handler.ts

@@ -7,7 +7,7 @@ import { annotate, eventStorage, getEvent } from "./logging/context";
 import { emitIfSampled } from "./logging/transports";
 import { redactOptional, redactSecrets } from "./logging/redact";
 import { getSession } from "./auth/session";
-import { auditLog } from "./auth/audit";
+import { auditLog, recordDelegatedAccess } from "./auth/audit";
 import {
   resolveBearerToken,
   BearerAuthError,
@@ -879,6 +879,12 @@ export async function requireRecordAuth(
   // Fire-and-forget, the `ApiToken.lastUsedAt` posture: the read must not wait
   // on the bookkeeping, and the bookkeeping failing must not fail the read.
   void touchGrantUsage(grant.id);
+  // The owner's copy of the same fact, and the one they can read: a day-
+  // coalesced row on their own record saying who opened it. It lands here
+  // rather than in the handlers because a route cannot forget what it never
+  // had to remember — every delegated request in the product passes through
+  // this line, and only requests that got past the grant check reach it.
+  void recordDelegatedAccess(owner.id, auth.user.id);
 
   return {
     session: auth.session,