Track when a user enables/disables transcription during a call.

This enables per-message privacy filtering based on when transcription was actually enabled.

Args: call_session_id: Call session ID (UUID or instant match session ID) user_id: User ID who is changing their transcription state enabled: Whether transcription is being enabled (True) or disabled (False) reason: Reason for change - "user_toggled", "quota_exceeded", "initial_setting"

🔒 Had zero auth dependency. This drives per-message privacy filtering (whether a transcript line is retained), so an outsider who knew a call_session_id could forge "transcription enabled" history for a call they were never in. Now requires the caller to be an authenticated participant of the session, and the recorded user_id is always the caller's own id — a client-supplied user_id can no longer forge another participant's transcription-state history.