Record acceptance of the Terms of Service

Session + CSRF required. The console posts the LEGAL_VERSION it rendered on the first authenticated session after sign-in, and on any session where the version it renders differs from the one the response reports. Idempotent: re-posting the version already on the account writes nothing and returns the original terms_accepted_at with recorded: false. A different version replaces the record, which is the re-acceptance path after a terms change. Acceptance is recorded per account, and each write leaves an auth.terms_accepted audit row.