feat: Phase 1 Group 3 — add account_id to step_ratings and step_usage_log

Backfill from rater/user's account_id (not the step's account_id).
This is an explicit design decision — step rating data is attributed
to the account that performed the rating.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_phase1_migrations.py

@@ -221,3 +221,80 @@ async def test_ai_suggestion_account_id_matches_user(test_db: AsyncSession):
     )
     row = result.scalar_one()
     assert row.account_id == account.id
+
+
+# ── Group 3: Steps & ratings ──────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_step_rating_account_id_is_rater_account(test_db: AsyncSession):
+    """step_ratings.account_id must be the RATER's account, not the step's account."""
+    from app.models.step_library import StepLibrary, StepRating
+
+    account_a, user_a = await _make_account_and_user(test_db, "sr-rater")
+    account_b, user_b = await _make_account_and_user(test_db, "sr-step-owner")
+
+    # Step owned by account_b
+    step = StepLibrary(
+        title="A step",
+        step_type="action",
+        content={"text": "do something"},
+        created_by=user_b.id,
+        account_id=account_b.id,
+        visibility="public",
+    )
+    test_db.add(step)
+    await test_db.flush()
+
+    # user_a (account_a) rates the step
+    rating = StepRating(
+        step_id=step.id,
+        user_id=user_a.id,
+        account_id=account_a.id,  # rater's account, not step owner's
+        was_helpful=True,
+        is_verified_use=False,
+        is_visible=True,
+    )
+    test_db.add(rating)
+    await test_db.commit()
+
+    result = await test_db.execute(select(StepRating).where(StepRating.id == rating.id))
+    row = result.scalar_one()
+    assert row.account_id == account_a.id, (
+        f"account_id should be rater's account ({account_a.id}), got {row.account_id}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_step_usage_log_account_id_is_logger_account(test_db: AsyncSession):
+    """step_usage_log.account_id must be the LOGGER's account (user who used the step)."""
+    from app.models.step_library import StepLibrary, StepUsageLog
+
+    account, user = await _make_account_and_user(test_db, "sul1")
+    tree = await _make_tree(test_db, account, user)
+    session = await _make_session(test_db, account, user, tree)
+
+    step = StepLibrary(
+        title="A usage step",
+        step_type="action",
+        content={"text": "do something"},
+        created_by=user.id,
+        account_id=account.id,
+        visibility="team",
+    )
+    test_db.add(step)
+    await test_db.flush()
+
+    log = StepUsageLog(
+        step_id=step.id,
+        user_id=user.id,
+        account_id=account.id,
+        session_id=session.id,
+    )
+    test_db.add(log)
+    await test_db.commit()
+
+    result = await test_db.execute(select(StepUsageLog).where(StepUsageLog.id == log.id))
+    row = result.scalar_one()
+    assert row.account_id == account.id, (
+        f"account_id should be logger's account ({account.id}), got {row.account_id}"
+    )