fix: wrap /auth/me response in user object to match frontend types

Frontend expects {user: {id, email, name, avatar_url}} but backend
was returning flat object. This caused auth state to fail parsing.

apps/api/src/api/auth.py

@@ -1,6 +1,6 @@
 import logging
 from secrets import token_urlsafe
-from typing import AsyncGenerator, Literal, cast
+from typing import Any, AsyncGenerator, Literal, cast
 
 import httpx
 from fastapi import APIRouter, Cookie, Depends, HTTPException, Response, status
@@ -150,7 +150,7 @@ async def logout(response: Response) -> dict[str, str]:
 async def me(
     session_cookie: str | None = Cookie(default=None, alias="session"),
     session: AsyncSession = Depends(get_db_session),
-) -> dict[str, str]:
+) -> dict[str, Any]:
     if not session_cookie:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="missing session")
 
@@ -166,8 +166,10 @@ async def me(
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="user not found")
 
     return {
-        "id": str(user.id),
-        "email": user.email,
-        "name": user.name,
-        "avatar_url": user.avatar_url or "",
+        "user": {
+            "id": str(user.id),
+            "email": user.email,
+            "name": user.name,
+            "avatar_url": user.avatar_url or "",
+        }
     }