/api/ingest 改为依赖 get_current_user, 以登录用户名作为 owner; 移除 ingest_owner 配置与开放模式合成用户/INGEST_OWNER 回落, 采集归属与登录态强绑定

security: /api/ingest 不再豁免 DeploymentAuthMiddleware(改走统一登录); 智能体/外部JD同步等机器调用仍走 INGEST_TOKEN

同步更新后端测试(conftest/auth/ingest/external_claims/pool/reports/recruiting_rules_agent), 122 passed

浏览器扩展 v1.5(弹窗/后台/README) 与 start_server.py 监听 0.0.0.0

新增 docs/adr/0007-per-user-ingest-attribution.md