fix(auth): move session warning proxy from session to user object

[mandarini]

Summary

Fixes false positive security warnings by moving the proxy from the session level to the user object level.

Changes

• Before: Warning triggered when accessing session.user
• After: Warning triggers when accessing properties like session.user.id

This eliminates false positives from JSON.stringify(), internal SDK checks, and framework object inspection while maintaining security for actual insecure usage patterns.

Testing

• Updated existing warning tests to reflect new behavior
• Added tests for edge cases: destructuring, spread operator, Object.keys(), JSON.stringify()

Fixes #1709

[coveralls]

coverage: 95.455% (-0.4%) from 95.853%
when pulling 9a75634 on fix/session-user
into e8a644e on master.