feat(auth): add GET /auth/me principal endpoint (#70)

[rrrodzilla]

Closes #70.

What

Adds GET /api/v1/forge/auth/me — the authenticated principal as the server resolves it:

{
  "user_id": "user_01k...",
  "email": "roland@govcraft.ai",
  "display_name": "Roland Rodriguez",
  "roles": ["admin"],
  "tenant_chain": [{ "schema": "Organization", "entity_id": "organization_01k..." }],
  "active_tenant": { "tenant_type": "Organization", "tenant_id": "organization_01k..." },
  "active_tenant_header": "x-active-tenant",
  "principal_claims": { }
}

This is the client-side anchor #70 asks for: a browser can't decrypt the PASETO, so it had no way to learn its own user_id, its memberships, or the active tenant without a racy email → user_id lookup. /auth/me returns all of it directly.

Scope decision — switch-tenant uses what #67 already shipped

The issue (written before #67 landed) also requested POST /auth/switch-tenant that mints a fresh PASETO carrying an active_tenant claim. #67 chose a different, already-shipped model: the active tenant is a per-request X-Active-Tenant: <type>:<id> header, resolved by the tenant_scope middleware against the user's memberships. Under that model:

• Switching tenants needs no new token and no new endpoint — the client just sends a different header. (Per the maintainer steer: use what's shipped if it meets the use case.)
• /auth/me reports active_tenant by honoring that same header: a valid member → that tenant; a sole membership → implied; otherwise null (the client must choose). It also returns active_tenant_header so clients don't hard-code the name.

If a sticky token-claim model is later preferred over the header, that's a separate follow-up; this PR deliberately avoids a second source of truth for active-tenant.

Notable change

tenant_scope middleware now skips /forge/auth/*. Necessary because /auth/me must return the full membership set, but the middleware refuses multi-membership requests that lack X-Active-Tenant (400 ACTIVE_TENANT_REQUIRED) — i.e. it would reject exactly the users /auth/me exists to serve. This also quietly fixes /auth/refresh, which carries no tenant context of its own, for multi-membership users.

Tests

• 7 unit: resolve_active_tenant (empty / sole / multi / header-selected / non-member / malformed) + MeResponse serde shape.
• 4 integration (auth_login.rs): full membership set returned; active tenant resolved from header; non-member header → null; no claims → 401.
• cargo clippy -p schema-forge-acton --all-targets clean; full crate suite green (460 passed).

Out of scope / notes

• No version bump (release bumps land separately, per chore(release): bump cli 0.32.0, acton 0.31.0, backend 0.12.0 #65).
• No public-trait changes — reuses list_tenant_memberships added in auth/login does not populate tenant_chain from TenantMembership rows #67.
• --all-features can't be exercised in my env (the FIPS aws-lc-fips-sys C build fails locally, unrelated to this change); validated with default features incl. surrealdb.