An Option that described a state the system could not produce

An Option that described a state the system could not produce `Caller::identity_id` was `Option`, and there is exactly one place a `Caller` is constructed — several lines after `authorize` has already refused a key with no identity. The `None` was unreachable from the day it was written. What an impossible state buys you is handlers guessing at it. A `let Some(..) else` returning an empty list. Another returning a 403 with a sentence about machine keys behind them. An `ok_or` in four modules, each choosing its own refusal. A `person()` helper in `engagement.rs` whose doc comment admitted it was unreachable and pointed at the TASKS item this commit closes. Six different answers to a question nobody asks. And six `if caller.identity_id.is_some() { User } else { ApiKey }` ternaries deciding an audit row's `actor_kind`, every one of which has been resolving to `User` since `authorize` was written while reading in review like a real branch. An audit log that appears to distinguish people from machines, and cannot. Roughly sixty sites across twenty-five handlers, which is why TASKS.md carried it as its own change rather than a tidy-up. **The site that should not have changed is the interesting one.** `tus.rs` binds an identity from `auth::authenticate`, not from a `Caller`, and there a machine key genuinely has none — authentication happens before authorisation, and only the latter refuses. Removing that `ok_or` compiled perfectly and would have been a real regression. It is restored, and now carries a comment naming the distinction so it does not read like the ones around it that were dead.