a7fc406781
The direct PAT authentication path returned identity only, so a user-actor token reaching it (admin routes and other direct callers) lost its environment scope. The claims now ride on the authentication result itself.