api: add user-resolution middleware and POST /api/setup

resolveUser attaches the session's provisioned geniusrun user (if any) to
request context without blocking; requireProvisionedUser (wired fully in
Task 13) 403s routes that need one. GET /api/session/me now reports
has_profile/display_name so the frontend can show the setup screen.

backend/internal/api/session.go

@@ -24,8 +24,10 @@ type SessionConfig struct {
 }
 
 type sessionMeResponse struct {
-	Name  string `json:"name"`
-	Email string `json:"email"`
+	Name        string `json:"name"`
+	Email       string `json:"email"`
+	HasProfile  bool   `json:"has_profile"`
+	DisplayName string `json:"display_name,omitempty"`
 }
 
 func (s *Server) handleSessionLogin(w http.ResponseWriter, r *http.Request) {
@@ -92,5 +94,10 @@ func (s *Server) handleSessionMe(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusUnauthorized, "not authenticated")
 		return
 	}
-	writeJSON(w, http.StatusOK, sessionMeResponse{Name: claims.Name, Email: claims.Email})
+	resp := sessionMeResponse{Name: claims.Name, Email: claims.Email}
+	if u, found := userFromContext(r.Context()); found {
+		resp.HasProfile = true
+		resp.DisplayName = u.DisplayName
+	}
+	writeJSON(w, http.StatusOK, resp)
 }