feat(api): GET /api/me

Returns the authenticated user (id/username/is_admin). Shape
matches UserView used in the login response so SPA stores stay
typed against one interface.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/me.go

@@ -0,0 +1,25 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
+)
+
+func (h *handlers) handleGetMe(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		// Hitting /me without RequireUser in front of it is a routing bug;
+		// it can't happen in real traffic.
+		h.logger.Error("api: /me reached without authenticated user")
+		writeErr(w, http.StatusInternalServerError, "server_error", "missing auth context")
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(UserView{
+		ID:       user.ID,
+		Username: user.Username,
+		IsAdmin:  user.IsAdmin,
+	})
+}