feat(auth): /auth/me returns workspaces[] with id/name/slug/role

GET /auth/me now responds with the new UserMeResponse: the existing
user fields plus default_workspace_id and a workspaces list that
joins WorkspaceRepository.list_by_user with the caller's role from
WorkspaceMembershipRepository.list_by_user. Stage 0 every user has
exactly one entry there, but the shape is forward-compatible for
Stage 2 multi-workspace memberships.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/gateway/auth/models.py

@@ -47,6 +47,26 @@ class UserResponse(BaseModel):
     needs_setup: bool = False
 
 
+class UserMeWorkspace(BaseModel):
+    """One workspace entry in ``GET /auth/me`` (Stage 0 PR4)."""
+
+    id: str
+    name: str
+    slug: str
+    role: str
+
+
+class UserMeResponse(BaseModel):
+    """Response model for ``GET /auth/me`` — extends UserResponse with workspaces."""
+
+    id: str
+    email: str
+    system_role: Literal["admin", "user"]
+    needs_setup: bool = False
+    default_workspace_id: str | None = None
+    workspaces: list[UserMeWorkspace] = []
+
+
 class ActiveWorkspace(BaseModel):
     """Lightweight workspace proxy injected into the request-scoped contextvar.