Centralize created_by stamping in UserStampable

[maebeale]

🤖 suggested review level: 5 Inspect 🔬 changes an anti-forgery security invariant (created_by force) and removes manual attribution across ~14 controllers

Stacked on #2024 — review/merge that first (base is maebeale/updated-by-stamping, not main).

Why

created_by was force-assigned to current_user in ~14 controllers — partly boilerplate, but where created_by_id is mass-assignable it also served as an anti-forgery override (tested: "records the current user as created_by regardless of submitted value" in stories/workshops/community_news specs).

What

• UserStampable now also stamps created_by_id on create, forcing Current.user (via before_validation) so a mass-assigned created_by_id can't override it. Only on new_record?, so a later editor never claims created_by.
• Removed the redundant manual created_by = current_user assignments from the create actions.
• Removed the per-controller comment authorship loops (workshops, scholarships, organizations, people, event_registrations, users). Comment#body is a plain column and comments don't permit the stamp columns as nested params, so the concern already forces created_by and stamps updated_by on both new and edited comments — the loops were dead code.

Deliberately left alone

• Services (WorkshopFromIdeaService, WorkshopVariationFromIdeaService, ProcessConfirmation) keep their explicit user: argument — they can run where Current.user isn't set, and the value may legitimately be nil (public self-registration).
• Parent updated_by on association-only saves (e.g. @user.updated_by = current_user on user update). The concern only stamps updated_by when the record's own columns change; adding/removing a nested record leaves the parent unchanged, so those still assign by hand.

Tests

• user_stampable_spec updated for the force behavior; ran the full request-spec set for every touched controller — all green. Notably scholarships_spec still asserts comment.created_by == admin through the nested form, confirming the concern covers comments.