refactor(controlplane): publish usercontext/entities under pkg/
The identity context helpers (CurrentUser, CurrentAPIToken, CurrentOrg, CurrentMembership) live under app/controlplane/internal/, yet the public app/controlplane/pkg/biz depends on them: AuditorUseCase.Dispatch resolves the audit actor from those context values.
Modules that embed pkg/biz therefore cannot populate the actor — Go's internal rule blocks the import, and the context keys are unexported empty structs so they cannot be set any other way. The result is that every audit entry whose RequiresActor() is true gets dropped with failed to get actor information, and the rest are attributed to SYSTEM.
This moves the package to app/controlplane/pkg/usercontext/entities so those consumers can populate the actor. Import-path change only, no behaviour change.