Add optional legalEntityPublicId to the import reference review contract so the host can pass the selected import target to an App. Existing implementations remain compatible. Adopt the matching Core and People changes to use it; server authorization remains required.