/api/log-error accepts ungated session, attacker-controlled attribution in appEvents

route.ts:215 — appEvents write attributed to a session before role resolution, not genuine-Google-gated. Not attacker-volume-limited (4 compensating controls: same-origin, char caps, email cap, DB flood cap) but attribution itself is spoofable by an email/password session. pmmaster flag: appEvents is becoming the evidentiary base for bind-event/misroute detection tonight — polluting it with attributable-but-unauthenticated rows degrades that signal. Found during fleet GoTrue roleless-path sweep, coder-mars-cc's enumeration.