feat(BL-P2-093): live-sync actor_ctx.user_id on cloud switch

[bluejayA]

Summary / 요약

• EN: BL-P2-085 follow-up. Threads the Keystone token's user.id UUID through Token, AppEvent::ContextChanged, and the App::handle_event handler so the shared actor_ctx.user_id follows a runtime cloud-switch — closing the multi-cloud audit attribution gap and the fingerprint v1 dedup leak.
• KR: BL-P2-085 fast-follow. actor_ctx.cloud만 live update되고 user_id는 wire-startup에 고정되던 문제. 다른 자격증명으로 재인증한 후 cross-project block audit이 이전 user_id로 attribute되어 멀티클라우드 추적성을 망가뜨리고, 동시에 fingerprint v1 canonical (v1\|user\|active\|origin\|target\|action\|resource_id)에 포함된 user가 cloud별로 갈라져 dedup이 깨지던 부분을 해결.

What changed

Layer	Change
Token (src/port/types.rs)	New user_id: String field, #[serde(default)] empty fallback
Keystone parse (src/adapter/auth/keystone.rs)	Optional KeystoneUser { id } block; parse_token extracts user.id; sample JSON + assertions updated
AppEvent::ContextChanged (src/event.rs)	New user_id: String field with docstring naming BL-P2-093 intent
App::handle_event (src/app.rs:635)	Writes actor_ctx.user_id only when non-empty (preserves prior value on test/rescope paths that lack a user block)
App::spawn_switch{,_back} (src/app.rs:~1715/1756)	Carry snapshot.token.user_id into the event
main.rs startup	Prefers Keystone UUID from get_token_info() over wire username; falls back to "unknown"
Token literal call sites (11) + ContextChanged construction sites (8)	Mechanically updated

TDD trail

• RED: test_context_changed_updates_actor_user_id (compile error E0559 — no field user_id on ContextChanged).
• GREEN: same test passes after wiring; asserts both cloud and user_id reflect the event.
• Bonus: test_parse_token_no_catalog asserts empty fallback; test_parse_token_from_keystone_response asserts the populated path.

Verification

• cargo test → 1493 passed (main = 1492 → +1 new test)
• cargo clippy --all-targets -- -D warnings → clean
• cargo fmt --all -- --check → clean

Out of scope (registered follow-ups)

• Token refresh hooks may swap user_id mid-session (BL-P2-052 token refresh part)
• Fingerprint v2 schema bump remains BL-P2-094 (v1 still LOCKED)
• Username/UUID display mapping (UI side) — not affected; current path is UUID-first

Risk

• All non-Keystone Token constructions (tests/mocks) populate empty user_id and remain GREEN under the "empty = no change" semantics in handle_event.
• #[serde(default)] on the new field keeps disk-cached token JSON forward-compatible.

Test plan

• DevStack manual: switch from cloud-A → cloud-B with distinct user credentials; trigger cross-project mutation; confirm audit user reflects cloud-B's UUID and fingerprint differs from a same-user/same-pattern cloud-A entry.
• Unit: test_context_changed_updates_actor_user_id (cloud + user_id propagation)
• Unit: test_parse_token_from_keystone_response + test_parse_token_no_catalog (populated + missing user block)
• Suite: all 1493 tests pass
• Lint: clippy + fmt clean

Refs: cargo-review branch-full report 2026-05-12 (Suggestions #1). Parent: #85 (BL-P2-085 atomic security).

🤖 Generated with Claude Code