fix(review): show friendly decision actor names

[Chris0Jeky]

Summary

• Add a server-resolved decidedByUserName to proposal responses using one batched user lookup for list reads and the existing single-proposal decision/read responses.
• Render the applied decision record with the friendly name and show the localized Not recorded fallback when legacy actor metadata cannot resolve; never render the raw GUID as the actor name.
• Add application, API, and frontend regression coverage.

Refs #2195

Verification

• dotnet test backend/tests/Taskdeck.Application.Tests/Taskdeck.Application.Tests.csproj --filter FullyQualifiedName~AutomationProposalServiceTests — 149 passed.
• dotnet test backend/tests/Taskdeck.Api.Tests/Taskdeck.Api.Tests.csproj --filter FullyQualifiedName~AutomationProposalsApiTests — 56 passed.
• npm run test -- src/tests/components/review/ReviewAppliedDecisionRecord.spec.ts — 4 passed.
• npm run typecheck — passed.
• npx eslint src/components/review/ReviewAppliedDecisionRecord.vue src/tests/components/review/ReviewAppliedDecisionRecord.spec.ts src/types/automation.ts — passed.
• git diff --check — passed.

Contract boundary

The current proposal lifecycle stores only the deciding user ID. API-key and agent-specific actor identities are not separately persisted or supplied to the approval/rejection contract, so this slice resolves the owner user name and leaves unsupported legacy/actor-kind cases explicitly unavailable instead of guessing or exposing an opaque ID. A separate actor-kind contract would be follow-up scope.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Chris0Jeky]

The connector usage-limit notice is informational, not a review finding. This PR is being checked through the independent coordinator review path; no code action is requested from this notice.

[Chris0Jeky]

Post-fix adversarial pass at head ffecb26: SHIP. The hosted PaperReview failure was a stale fixture that supplied only the legacy actor id; the fixture now models the API-enriched friendly name and asserts Ada, while the component still deliberately renders Not recorded when no friendly name exists. No opaque actor id is exposed. Local proof: ReviewAppliedDecisionRecord + PaperReview 159/159, Application actor tests 149/149, API actor tests 56/56, npm run typecheck, npx eslint on touched frontend files, git diff --check. No new CRITICAL/HIGH findings.

[Chris0Jeky]

Coordinator final re-review after #2556 landed (head 866c8d5, base b8878c9): SHIP on the #2195 delta. The live diff is limited to the actor-name backend contract/repository/service path, review display, and tests. The prior Windows-only failure was the unrelated high-volume launcher fixture and is now fixed in main; refreshed hosted checks are pending. No new correctness, security, or data-loss blocker found.

[Chris0Jeky]

Coordinator second adversarial pass after base refresh (head 97780f19399915be546694b85b9e30fa4435b1db, base 8ee85507b2bc0958b24de3175dee17ba7d73304e): SHIP on the #2195 delta. The merge-based refresh adds only the already-reviewed #2464 capture-generation commit to the base; this PR's live diff remains limited to actor-name enrichment/display and its application/API/frontend coverage. The current lifecycle persists only user IDs, so unsupported agent/key actor kinds remain explicitly Not recorded rather than guessed or leaked as GUIDs. git diff --check is clean. No new CRITICAL/HIGH correctness, security, or data-loss finding.