#2705 serve audit: auth.token.used hardcodes principalKind user for worker tokens

In src/serve/token_auth.ts (emit for auth.token.used, around line 313) the audit event sets principalKind to the literal user for every token, and principalId to the full kind-prefixed principal string (for example worker:build-1). A worker token therefore audits as principalKind user with principalId worker:build-1, which is inconsistent with other serve audit events (audited.ts, shared.ts) that store the kind in principalKind and the bare id in principalId. Audit query filters, alert matches and compliance reports that group on principalKind/principalId get the wrong answer for worker tokens. Fix: parse the principal (parsePrincipal) and use its kind and id. Found while triaging swamp-club#2464.