Whoami Endpoint

Return the authenticated user and token-selected org, if any.

Same JWT shape as /api/auth/me — accessible from the CLI via the Bearer access_token issued by /oauth/token. Used both as codag whoami and as the post-login validation step in codag setup.