Fold a batch of paywall funnel events onto the caller's journey row.

A non-consented caller gets the same 200 and the same body as a consented one: the client did nothing wrong, must not retry, and must not be able to read its consent verdict off the response.

Auth is enforced by the global JWT middleware before we get here (this prefix is absent from AuthMiddleware.public_paths), so request.state.user_id is already populated - identity never comes from the request body.