Upsert the peer leader's own commitment (AC3, IV3)

MED-1133 (E4.5a) — PRIVACY: a peer leader may only record their OWN commitment. The card now sends just the leader's row; any row whose participant_user_id is not the leader is dropped at the data layer (AC2) and logged for audit. The leader's row is stored as a self-authored commitment (coach_user_id NULL) — the same single (session_id, participant_user_id) row E3.4 uses, so it cannot duplicate E3.4 data (IV3). MED-1216 / AC1: commitment_text must be non-empty (whitespace-only rejected, 400) — no blank saves. The response contains only the leader's own commitment (0 or 1 row).