docs: token actor, connection deleted_at and CSRF decisions; follow-ups

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -26,9 +26,11 @@ user layer or files a Changes-inbox event.
 HTTP request (`apps/server`):
 1. `Bun.serve` routes `/api/*` and `/ingest/*` to `app.fetch`; everything else gets the web app (HTML import).
 2. `apiHandler` matches method + path in the route table, applies the per-IP rate limit (login/register), authenticates
-   (`session` cookie `stt_session`, Bearer app token with a scope, or either), checks `X-Requested-With: sttracker` on
-   cookie-authenticated writes, reads the body (JSON ≤ 1 MB, multipart ≤ 50 MB) and validates it with zod.
-3. The handler calls one core function with the caller's `userId` and actor `"user"`. Core enforces ownership
+   (`session` cookie `stt_session`, Bearer app token with a scope, or either), requires `X-Requested-With: sttracker` on
+   every non-Bearer write (login included), reads the body (JSON ≤ 1 MB with `Content-Type: application/json`,
+   multipart ≤ 50 MB) and validates it with zod.
+3. The handler calls one core function with the caller's `userId` and actor (`token:<name>` for Bearer, else `"user"`;
+   `field_sources` stores both as `"user"`). Core enforces ownership
    (`NotFoundError` → 404). Errors become `{ error: { code, message } }`; unknown errors are logged and return 500 `internal`.
 4. `POST sources/:id/run|import` only enqueue a `sync` job (lockKey `sync:<id>`, 409 when held); the worker runs it.