api: add user-resolution middleware and POST /api/setup

resolveUser attaches the session's provisioned geniusrun user (if any) to
request context without blocking; requireProvisionedUser (wired fully in
Task 13) 403s routes that need one. GET /api/session/me now reports
has_profile/display_name so the frontend can show the setup screen.

backend/internal/api/server.go

@@ -54,6 +54,9 @@ func (s *Server) Router() http.Handler {
 			r.Get("/session/me", s.handleSessionMe)
 			r.Post("/session/logout", s.handleSessionLogout)
 
+			r.Use(s.resolveUser)
+			r.Post("/setup", s.handleSetup)
+
 			r.Route("/profile", func(r chi.Router) {
 				r.Get("/", s.handleGetProfile)
 				r.Put("/", s.handleUpdateProfile)