deleteDocument now threads the acting user through to the audit log so
DOCUMENT_DELETED records who deleted the document, matching every other
audited write path (storeDocument, updateDocument, applyBulkEditToDocument,
attachFile). Tightens the AC-7 assertion from any() to the concrete actor.
Also adds the missing ApplicationEventPublisher @Mock to DocumentServiceTest,
which the publishEvent call (added with the cascade fix) left null.
Addresses @nora (CWE-778, blocker), @felix and @sara review on PR #806.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
c2b98e6e84