fix(audit): retain authenticated consume identity and exact binding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

approval_engine/api.py

@@ -176,6 +176,7 @@ class App:
                     approval_id,
                     data.get("request_digest"),
                     decision_id=data.get("decision_id"),
+                    consumer=identity,
                 )
         if "check" in path or path.endswith("/authorize"):
             return 404, {"error": "not_found", "message": "no such surface"}