Generate SAR narrative (BSA officer / admin session required)

Generate a FinCEN-style SAR narrative for a completed screening.

Auth: requires BOTH an org API key (X-API-Key, resolved via get_current_org) AND an authenticated bsa_officer/admin dashboard session (require_bsa_officer) — a kyt_token/ih_token cookie or an Authorization: Bearer <JWT>. The API key alone is never sufficient: require_bsa_officer resolves through get_current_user, which only reads the session cookie/bearer JWT and does not accept X-API-Key.

The served OpenAPI security block below only lists APIKeyHeader because FastAPI can't auto-document require_bsa_officer (it reads the cookie/JWT straight off the request instead of going through a fastapi.security dependency) — that omission previously made this look like a plain API-key-only endpoint in the published spec. A customer integration authenticating with only an API key will get a 401 from this endpoint even with a valid key.