Create an audit on the company an answer request is about

Creates an audit as the answer to an AUDIT question, on the company the request is about. The target company comes from the request's onBehalfOfCompanyId and is not accepted in the body. Only the answering company may call it, and only while the brand that issued the request is still connected to it; anyone else gets 404 request_not_found. Unlike POST /api/audits, the audit is then shared with the subject company and with the brand without requiring the sharer to be linked to them — the request is the authorization — so the factory can finally see its own audit. Through the generic endpoint that share needed an answering-party-to-subject connection, which a delegated party never has, so it threw and was swallowed. isPublic is not accepted and is always false: a public audit fans a read grant out to every company linked to the uploader, which would expose the subject company's audit to the answering party's entire network. A failed share is reported, not logged and forgotten.