fix(server): drift #578 — /api/me returns profile shape with display_name + email

Server-side fix for the drift audit finding (Scribe #578, parent
#552). Mirrored on Android (and Flutter) but the root cause and
the smallest blast-radius fix both live here.

The bug:
- Android MeApi.getProfile() calls GET /api/me and deserializes
  into MyProfileWire which has nullable display_name + email.
- Server's handleGetMe was emitting the narrower UserView shape
  (id, username, is_admin only).
- Android always saw displayName=null, email=null. The Settings →
  Profile screen rendered BLANK form fields for users with stored
  values.
- Saving from the blank state submitted empty strings to
  PUT /api/me/profile, which interprets empty as "clear to NULL"
  (me_profile.go:53-65) — DESTROYING the user's saved profile.
- Flutter (flutter_client/lib/api/endpoints/settings.dart:9-12)
  has the identical bug pattern.

The fix:
- handleGetMe now emits profileViewFromUser(user) — the same
  shape PUT /api/me/profile already returns (meProfileResp:
  id, username, display_name, email, is_admin).
- auth.UserFromContext already returns a full dbq.User row, so no
  extra DB lookup needed.
- Web's User TypeScript type is narrower than this response but
  doesn't care about the extra fields (TS structural typing).
- LoginResp.User still uses UserView; login response unchanged.

New test asserts the regression directly: a user with stored
display_name + email sees them in /api/me. Old test updated to
decode into meProfileResp and assert the nullable fields are
correctly null for an unset profile.

Android side needs no change — the existing wire shape already
expected display_name + email; this just delivers them.

internal/api/me.go

@@ -1,7 +1,6 @@
 package api
 
 import (
-	"encoding/json"
 	"errors"
 	"net/http"
 
@@ -9,6 +8,22 @@ import (
 	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 )
 
+// handleGetMe returns the authenticated user's profile shape — id,
+// username, display_name, email, is_admin. Mirrors the response shape
+// of PUT /api/me/profile so the Android Settings → Profile screen
+// (and Flutter's equivalent) can read its starting state from a GET
+// before the user has done a first save.
+//
+// Drift #578 fix: this previously emitted the narrower UserView
+// (id, username, is_admin only). Android's MeApi.getProfile() deser-
+// ialised into MyProfileWire and saw display_name=null, email=null
+// on every read — wiping the form fields on every Settings open.
+// Saving from that blank state then submitted empty strings, which
+// handleUpdateMyProfile treats as "clear to NULL" — DESTROYING the
+// user's stored display_name + email. Returning the full profile
+// shape here closes the loop. Web (User type narrower than this
+// response) keeps working via TypeScript structural typing — the
+// extra fields are ignored.
 func (h *handlers) handleGetMe(w http.ResponseWriter, r *http.Request) {
 	user, ok := auth.UserFromContext(r.Context())
 	if !ok {
@@ -18,10 +33,5 @@ func (h *handlers) handleGetMe(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, apierror.InternalMsg("missing auth context", errors.New("missing auth context")))
 		return
 	}
-	w.Header().Set("Content-Type", "application/json")
-	_ = json.NewEncoder(w).Encode(UserView{
-		ID:       user.ID,
-		Username: user.Username,
-		IsAdmin:  user.IsAdmin,
-	})
+	writeJSON(w, http.StatusOK, profileViewFromUser(user))
 }