fix(uds-auth): explain why skills get no credentials for a session (0.3.18)

Skill credentials follow the DSH session owner, so a chat created under
the emergency account stays owned by administrator after a QR scan and
skills cannot get a UAC token there. The generic "scan QR first" error
hid this.

- Return session_owner_no_uac when the owner is administrator / a local
  account, telling the user to start a new session after QR sign-in.
- Name the owner in no_skill_credentials for UAC owners.
- Audit denied outbound calls with session id and owner.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

uds-auth/lib/i18n.js

@@ -180,7 +180,8 @@ export const MESSAGES = {
     'err.session_workspace_only': '只能在自己的工作区创建会话',
     'err.workspace_path_only': '只能打开自己的工作区路径',
     'err.workspace_create_forbidden': '只有管理员可以创建工作区',
-    'err.no_skill_credentials': '请先完成 UAC 扫码登录',
+    'err.session_owner_no_uac': '此会话归属 {owner}（应急 / 本机账号），没有 UAC 凭证；扫码登录不会改变已有会话的归属。请在扫码登录后新建会话再使用',
+    'err.no_skill_credentials': '会话归属 {owner} 的 UAC 登录已失效或未保存凭证，请该账号重新扫码登录后重试',
     'err.loopback_only_credentials': 'agent-credentials 仅允许本机访问',
     'err.loopback_only_outbound': 'outbound 仅允许本机访问',
     'err.url_required': '缺少 url',
@@ -372,7 +373,8 @@ export const MESSAGES = {
     'err.session_workspace_only': 'Sessions can only be created in your own workspace',
     'err.workspace_path_only': 'You can only open your own workspace path',
     'err.workspace_create_forbidden': 'Only admins can create workspaces',
-    'err.no_skill_credentials': 'Complete UAC QR sign-in first',
+    'err.session_owner_no_uac': 'This session is owned by {owner} (emergency / local account) which has no UAC credentials; scanning does not change who owns an existing session. Start a new session after QR sign-in',
+    'err.no_skill_credentials': 'UAC sign-in for session owner {owner} is missing or expired; scan the QR code again as that account and retry',
     'err.loopback_only_credentials': 'agent-credentials is loopback-only',
     'err.loopback_only_outbound': 'outbound is loopback-only',
     'err.url_required': 'url required',