Function log_event_hit 

pub fn log_event_hit(
    hit: &UsageLimit,
    incident_id: &str,
    scheduled_resume_at: Option<DateTime<Utc>>,
    fallback_used: bool,
) -> LogEventKind

Build a crate::session_log::LogEventKind::UsageLimitHit from a detected UsageLimit. Single source of truth for the scheduled-resume path — every site that knows a resume timer is going to fire (relay, foreground auto-resume loop) calls this so the wire shape can never drift.

scheduled_resume_at and fallback_used come from compute_resume_at. incident_id is provided by the caller so it can be stitched into the matching UsageLimitResumed / UsageLimitResumeFailed events.