feat(api): add protected GET /api/me and full auth round-trip test

apps/api/src/app.ts

@@ -1,10 +1,12 @@
 import { Hono } from 'hono';
 import { health } from './routes/health';
+import { me } from './routes/me';
 import { auth } from './auth';
 
 export function createApp(): Hono {
   const app = new Hono();
   app.route('/', health);
   app.on(['POST', 'GET'], '/api/auth/*', (c) => auth.handler(c.req.raw));
+  app.route('/', me);
   return app;
 }

apps/api/src/routes/me.ts

@@ -0,0 +1,20 @@
+import { Hono } from 'hono';
+import type { MeResponse } from '@solelog/shared';
+import { auth } from '../auth';
+
+export const me = new Hono();
+
+me.get('/api/me', async (c) => {
+  const session = await auth.api.getSession({ headers: c.req.raw.headers });
+  if (!session) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+  const body: MeResponse = {
+    user: {
+      id: session.user.id,
+      email: session.user.email,
+      name: session.user.name,
+    },
+  };
+  return c.json(body);
+});