api: add user-resolution middleware and POST /api/setup

resolveUser attaches the session's provisioned geniusrun user (if any) to
request context without blocking; requireProvisionedUser (wired fully in
Task 13) 403s routes that need one. GET /api/session/me now reports
has_profile/display_name so the frontend can show the setup screen.

backend/internal/api/setup_test.go

@@ -0,0 +1,65 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestSetup_ProvisionsNewUserWithDisplayName(t *testing.T) {
+	s, db := newTestServer(t)
+	router := s.Router()
+
+	rec := doJSON(t, router, http.MethodGet, "/api/session/me", nil)
+	var me sessionMeResponse
+	unmarshalBody(t, rec, &me)
+	if me.HasProfile {
+		t.Fatal("expected a brand-new session to have no profile yet")
+	}
+
+	rec = doJSON(t, router, http.MethodPost, "/api/setup", map[string]any{"display_name": "Lucie"})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("setup status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+
+	rec = doJSON(t, router, http.MethodGet, "/api/session/me", nil)
+	unmarshalBody(t, rec, &me)
+	if !me.HasProfile || me.DisplayName != "Lucie" {
+		t.Fatalf("session/me after setup = %+v, want HasProfile=true DisplayName=Lucie", me)
+	}
+
+	u, found, err := db.GetUserBySub(newCtx(), "test-user") // doJSON's test cookie's Sub
+	if err != nil || !found {
+		t.Fatalf("GetUserBySub: found=%v err=%v", found, err)
+	}
+	if u.DisplayName != "Lucie" {
+		t.Errorf("stored DisplayName = %q, want Lucie", u.DisplayName)
+	}
+}
+
+func TestSetup_RejectsEmptyDisplayName(t *testing.T) {
+	s, _ := newTestServer(t)
+	rec := doJSON(t, s.Router(), http.MethodPost, "/api/setup", map[string]any{"display_name": ""})
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+}
+
+func TestSetup_RejectsWhenAlreadyProvisioned(t *testing.T) {
+	s, db := newTestServer(t)
+	if _, err := db.ProvisionUser(newCtx(), "test-user", "Already Here"); err != nil {
+		t.Fatalf("ProvisionUser: %v", err)
+	}
+	rec := doJSON(t, s.Router(), http.MethodPost, "/api/setup", map[string]any{"display_name": "Someone Else"})
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("status = %d, want 409, body = %s", rec.Code, rec.Body.String())
+	}
+}
+
+func unmarshalBody(t *testing.T, rec *httptest.ResponseRecorder, v any) {
+	t.Helper()
+	if err := json.Unmarshal(rec.Body.Bytes(), v); err != nil {
+		t.Fatalf("unmarshal response body %q: %v", rec.Body.String(), err)
+	}
+}