web controller doesn't record paper_trail whodunnit

the web `ApplicationController` sets `PaperTrail.request.controller_info` (IP) but never sets `PaperTrail.request.whodunnit` or includes `PaperTrail::Rails::Controller`. the API controller does both correctly.

this means every mutation made through the web UI has a blank `whodunnit` in the versions table — we can't tell who did what.

found this while investigating an order edit on `pkg!6pnt96nw` for AGH Fulfillment — someone changed line items on a dispatched order through the web UI and we couldn't identify who because whodunnit was nil.

**fix:** either `include PaperTrail::Rails::Controller` in `ApplicationController` (which auto-sets whodunnit from `current_user`) or manually set `PaperTrail.request.whodunnit = current_user&.id` in `set_paper_trail_info`.