SSR auth flow now hydrates the full user from the database

The SSR auth pass was loading only the session token, not the full user record. Pages that depended on user fields (avatar, display name, biography) had to fetch them again on the client, which caused a visible flicker between "user not yet loaded" and "user loaded".

SSR now hydrates the full user from the database in the same pass as the session check. The flicker is gone and the initial paint shows the authenticated state directly.