refactor(api): scope controllers through current_resource_owner (#2414)

Follow-up to #2405. Replace remaining API controller reads of
Current.user, Current.family, and Current.session with
current_resource_owner. Add an architecture guard test to prevent
regression.

Scope is limited to the Current sweep only:
- Revert balance_sheet user-scoping (moves to account-auth PR B).
- Revert provider_connections DebugLogEntry logging (separate PR).
- Remove UsersController#destroy attempt to destroy unsaved API session.

app/controllers/api/v1/users_controller.rb

@@ -45,7 +45,6 @@ class Api::V1::UsersController < Api::V1::BaseController
     user = current_resource_owner
 
     if user.deactivate
-      Current.session&.destroy
       render json: { message: "Account has been deleted" }
     else
       render json: { error: "Failed to delete account", details: user.errors.full_messages }, status: :unprocessable_entity