SEC-02: Claims-first identity (remove actor query/body IDs)

[Chris0Jeky]

Source: docs/TaskdeckNextWorkChecklist.md (SEC-02)

Depends on:

• SEC-01

Scope:

• Retrofit remaining legacy controller families to claims-first identity.
• Remove reliance on caller-supplied actor identity for protected operations.

Acceptance Criteria:

• Protected endpoints derive actor identity from claims consistently.
• Query/body actor IDs are not used for authorization decisions.
• Existing happy paths remain intact.
• Integration coverage added/updated for impacted families.

Suggested branch:

• feature/security-claims-retrofit-phase2