docs(design): sync §4.6 role_id rules with #1643 passthrough behavior

[r266-tech]

Summary

Sync docs/design/account-namespace-shared-session-design.md §4.6 with the behavior merged in #1643 (fix(session): allow explicit role_id passthrough, qin-ctx, ~14h ago).

What #1643 changed

openviking/server/routers/sessions.py::_resolve_message_role_id was simplified: the auth-mode/role-based allow_explicit_role_id gate and the _ROLE_ID_PATTERN alpha-numeric regex validation were both removed. After #1643:

• All auth modes (including USER) can pass role_id explicitly, and the server uses the caller-provided value verbatim.
• If role_id is not provided, the server falls back to ctx.user.user_id (for role=user) or ctx.user.agent_id (for role=assistant) — same default as before.
• The server no longer enforces the ^[a-zA-Z0-9_-]+$ format or account-scoped legitimacy; those become caller responsibilities.

The design doc §4.6 still documented the pre-#1643 rules (USER rejected explicit role_id, server regex-validated the result, assistant.role_id had format/context checks), so a user reading the doc and hitting the runtime would see a mismatch.

Doc change (single file, +11/-12)

• USER bullet: rewrites "不接受显式传入" to "可以显式传入 role_id，服务端以传入值为准" + the same default-fill fallback as other modes.
• "额外约束" bullets: keep the semantic meaning of role_id for each role, but clarify validation is now caller-side and the server no longer performs regex / context-consistency checks.

No behavioral / API change; no English mirror exists for this file.

Why worth the change

The design doc is the canonical spec that reviewers and integrators consult before wiring role_id into clients. Leaving it documenting removed server-side guards would mislead downstream implementers into relying on validation that no longer runs, and into thinking USER-scoped API keys still reject explicit role_id.

Fixes doc/code drift from #1643. Pure docs, no tests/code changes.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

**🎫 Ticket compliance analysis **

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🏅 Score: 100

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

No code suggestions found for the PR.