feat(server/m7-user-mgmt): self-service /me endpoints (U3)

Four authenticated endpoints for the user's own account:

- PUT /api/me/password — change own password. Caller must
  supply current_password (verified via bcrypt). Distinct from
  admin-driven reset (which doesn't require knowing the old).
  Audits ActionPasswordChangeSelf.

- PUT /api/me/profile — set display_name + email. Both fields
  are nullable; empty string clears, omitted leaves unchanged.
  Email is lowercased before store + format-validated. Unique
  violation → 409 email_taken.

- GET  /api/me/api-token — returns current API token (for
  copy-paste into Subsonic clients).
- POST /api/me/api-token — regenerates token. Old one stops
  working immediately. Audits ActionTokenRegenerate.

All four use the existing RequireUser middleware on the authed
sub-router; audit writes are best-effort (logged on failure).

Tests cover happy paths, wrong-password 401, password-too-short
400, email-invalid 400, email-taken 409, clear-by-empty-string,
omit-leaves-unchanged, token GET + regen.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/api/me_token.go

@@ -0,0 +1,61 @@
+package api
+
+import (
+	"net/http"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/audit"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+)
+
+type apiTokenResp struct {
+	APIToken string `json:"api_token"`
+}
+
+// handleGetMyAPIToken implements GET /api/me/api-token.
+func (h *handlers) handleGetMyAPIToken(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeErr(w, http.StatusUnauthorized, "auth_required", "")
+		return
+	}
+	q := dbq.New(h.pool)
+	current, err := q.GetUserByID(r.Context(), user.ID)
+	if err != nil {
+		h.logger.Error("get api token: lookup failed", "err", err)
+		writeErr(w, http.StatusInternalServerError, "server_error", "")
+		return
+	}
+	writeJSON(w, http.StatusOK, apiTokenResp{APIToken: current.ApiToken})
+}
+
+// handleRegenerateMyAPIToken implements POST /api/me/api-token.
+func (h *handlers) handleRegenerateMyAPIToken(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeErr(w, http.StatusUnauthorized, "auth_required", "")
+		return
+	}
+	newToken, err := auth.MintSessionToken()
+	if err != nil {
+		h.logger.Error("regenerate api token: mint failed", "err", err)
+		writeErr(w, http.StatusInternalServerError, "server_error", "")
+		return
+	}
+	q := dbq.New(h.pool)
+	updated, err := q.RegenerateApiToken(r.Context(), dbq.RegenerateApiTokenParams{
+		ID:       user.ID,
+		ApiToken: newToken,
+	})
+	if err != nil {
+		h.logger.Error("regenerate api token: update failed", "err", err)
+		writeErr(w, http.StatusInternalServerError, "server_error", "")
+		return
+	}
+
+	if err := audit.Write(r.Context(), h.pool, user.ID, user.ID, audit.ActionTokenRegenerate, nil); err != nil {
+		h.logger.Warn("regenerate api token: audit failed", "err", err)
+	}
+
+	writeJSON(w, http.StatusOK, apiTokenResp{APIToken: updated.ApiToken})
+}