Make segment tracking more explicit

# Problem

We're moving away from using `ja_resource` and `canary` through #864

This makes controllers and authorization policies much more explicit and easier to follow.

However, segment tracking still relies on a plug which does it's tracking through inference of actions. We should make this explicit as well, by moving the code into controllers.

Additionally, all we should ensure all API actions which are supposed to call segment tracking actually do so.