Stamp the borrower quote's actor from the session

Shipped

July 19, 2026 at 1:30 AM UTC

Author

Kamo

Commit

5469b1c

The quote requires createdByMemberId and the browser must never supply it. memberId(req) is hoisted out of the party-check branch so it resolves for stewards too, 401s when absent, and is stamped onto the relayed request — matching MlosPricingController's existing "session-stamped, never the browser's" precedent.