refactor(web/auth): extract user state to break auth<->player cycle (B2)

web/src/lib/auth/user.svelte.ts

@@ -0,0 +1,19 @@
+// User state lives here so auth/store and player/store can share it
+// without a circular import. auth/store mutates via setUser; player/store
+// reads only. Both auth-flow consumers (login/register/logout) and any
+// component that needs the current user can import `user` from either
+// this module or auth/store — auth/store re-exports it for backward
+// compatibility.
+import type { User } from '$lib/api/client';
+
+let _user = $state<User | null>(null);
+
+export const user = {
+  get value(): User | null {
+    return _user;
+  }
+};
+
+export function setUser(u: User | null): void {
+  _user = u;
+}