[DEF-002] Hardcoded "dashboard-user" string replaces authenticated principal in 110+ audit log entries (FedRAMP AU-3 violation)

## Summary

The literal string `"dashboard-user"` is used as the actor identity (InitiatedBy / AssessorId / AuthoredBy / ResolvedBy / Actor / SubscribedBy) across at least 110 sites in the dashboard endpoint files. Every audit log entry written by these paths records a fake actor instead of the authenticated principal.

## Location

- `src/Ato.Copilot.Mcp/Endpoints/DashboardAssessmentsEndpoints.cs`
- `src/Ato.Copilot.Mcp/Endpoints/DashboardCategorizationEndpoints.cs`
- `src/Ato.Copilot.Mcp/Endpoints/CapabilitySubscriptionEndpoints.cs`
- +3 additional files (grep `'"dashboard-user"'` returns 110 matches across all)

## Severity

**HIGH** — Audit trail is unreliable; FedRAMP AU-3 requires attributable actor identity on every auditable event.

## Steps to Reproduce

```csharp
// Any create/update/delete endpoint in the affected files
// Inspect the persisted record's InitiatedBy / Actor field
// Actual value: "dashboard-user"
// Expected value: authenticated user identity (e.g. UPN or OID from ClaimsPrincipal)
```

## Fix Direction

Replace every `"dashboard-user"` literal with `HttpContext.User.GetUserId()` (or equivalent claims extraction helper). Add a test asserting that actor fields are never a hardcoded string.

## Compliance Impact

Violates FedRAMP AU-3 (Content of Audit Records). Blocks ATO authorization.

## Evidence Source

- Star-Lord QA audit `84b7431961aa4750` — grep `'"dashboard-user"'` → 110 matches
- Banner consolidated findings `539e6ef45fe842b8`

Start by grepping for the 110 occurrences of "dashboard-user" across the dashboard endpoint files, including DashboardAssessmentsEndpoints.cs, DashboardCategorizationEndpoints.cs, and CapabilitySubscriptionEndpoints.cs. Trace how each endpoint accesses the authenticated ClaimsPrincipal and run the relevant endpoint tests. Done means every affected audit field uses the authenticated identity and tests verify that no hardcoded actor remains.

Written by the indexing model from the issue text.