feat(auth): show real session identity in navigation

[woahwhattheheck]

Fixes #466

What changed

• Add an authenticated GET /api/auth/session endpoint that resolves the current user and organization from the verified JWT identity.
• Add a frontend auth/session provider with loading state and cross-route token reconciliation.
• Replace the hardcoded AppNav user with the authenticated name/email/wallet identity.
• Replace the hardcoded DashboardTopBar organization with the authenticated organization name.
• Add an explicit logout action that clears both existing frontend token keys and redirects to /login.
• Show lightweight account/organization skeletons while auth state resolves.

Scope

This does not change token issuance, OAuth/2FA semantics, RBAC, or route authorization beyond protecting the new session-read endpoint with the existing JWT middleware.

Validation

The branch is based directly on sponsor main@171c74b454daba241bfb75f36d10a0a3a77a68e5 and changes six files. Static readback confirms the prior fake user/org strings are gone and the new session route is authenticated. The repository build/test runner was not executed in this session, so no test-pass claim is made here.