feat: deliver schema 15 monthly settlement lifecycle

dashboard/authentication.py

@@ -315,6 +315,15 @@ def require_dashboard_authentication() -> bool:
         _render_login(clear_cookie=cookie is not None)
         return False
 
+    # The configured server-side admin identity is the only actor source.  Do
+    # not derive it from query parameters, client headers, or dashboard forms.
+    st.session_state["authenticated_actor"] = settings.admin_id
     log_auth_event("token_accepted", correlation_id)
     _render_logout()
     return True
+
+
+def get_authenticated_actor() -> str | None:
+    """Return the actor established by successful server-side authentication."""
+    actor = st.session_state.get("authenticated_actor")
+    return actor if isinstance(actor, str) and actor.strip() else None