Actor resolution

A raw controller audit line attributes a change to an opaque session identifier.
The timeline resolves these: session identifiers are mapped through the live
session store to "<username> (session:<abbreviated-id>…)". API key identifiers
and anonymous callers pass through unchanged. An expired session, whose mapping
is gone, degrades gracefully to the abbreviated identifier rather than
disappearing.

This is the mechanism that answers "who did this". Without it, the controller's
audit log attributes every UI-driven change to an anonymous or opaque principal.