feat(audit): record the client surface on audit entries and identify CLI login requests - #7823

Summary

• Adds a nullable surface column to audit_log (web, desktop, cli, sdk-js, sdk-python), written from the client the route wrapper already resolves per request, so every audit entry recorded while serving a request says which client it came from
  • Read from the ambient request context in the one row builder shared by recordAudit, recordAuditBatch, and recordAuditOnce, so no caller changes; null for background work and callers that don't identify themselves
  • Not added to any read projection: the v1/v2 audit APIs, admin API, and data drain all map fields explicitly, so responses and exports are unchanged
• Migration 0344_audit_log_surface is a single ADD COLUMN ... text (nullable, no default): metadata-only, compatible with the deployed app, which never writes it, and no contract step to follow. The snapshot diff is that one column
• The CLI's OAuth discovery, token exchange/refresh, and device-flow poll now send X-Sim-Client-Info like every other CLI request, so they carry the coding agent instead of falling back to user-agent attribution
  • One identityHeaders() helper now supplies the user agent and client info for the API client and all three login requests, replacing four hand-written copies
  • Drops an unused clientInfoHeader barrel export

Type of Change

• New feature

Testing

• New audit tests: surface recorded from the request context, and absent outside a request; confirmed they fail without the change
• Login token and device-poll tests assert both identity headers
• CLI suite passes with and without the publish job's telemetry env; audit, db, sim-cli, and apps/sim type-check
• bun run check:migrations, bun run lint, check:audits, and docs-manifest:check pass; full apps/sim suite passes apart from one unrelated timing test that passes on rerun

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)