Get transcript for an instant match session.

🔒 This used to forward to call_routes.get_call_transcript with three bare positional args (call_session_id, requesting_user_id, db) against a 4-parameter signature (call_session_id, requesting_user_id, current_user, db) — db silently landed in the current_user slot, so get_call_transcript's own authorization check (current_user.id) ran against a DB Session object instead of the caller, not a real caller identity. Fixed by depending on the actual User object here and passing every argument by keyword.