Sprint-1: me endpoint integration, token persistence, edge case hardening

[ibdevlawal]

Summary

Combined PR closing the me endpoint and token persistence workstreams.

Issues Closed

Closes #601 — me endpoint: harden edge cases and failure modes (S1-088)

• Added 404 NOT_FOUND test for valid JWT referencing a deleted/non-existent user
• Fixed JWT_SECRET fallback mismatch in auth-errors.test.ts and auth-guard.test.ts
  (tests used old fallback 'dev-secret-change-me' while env.ts uses
  'dev-secret-change-me-abcdefghijklmnopqrstuvwxyz123' — caused all
  token-verification tests to silently fail)
• Fixed error middleware crash: logger.error() was called without the required
  LogContext third argument, causing formatContext(undefined) to throw before
  res.json() could send the response. Unhandled errors now correctly return
  500 with INTERNAL_SERVER_ERROR code.

Closes #602 — me endpoint: integrate and document (S1-089)

• Added getMe(accessToken) to apps/web/src/lib/api-client.ts
• Added getJson helper for authenticated GET requests
• Attaches error.code from API response for programmatic error handling
• Updated apps/docs/me-endpoint.md to show web is wired (getMe() instead of 'Not yet exposed')

Closes #603 — token persistence: define scope and contracts (S1-084)

• Created apps/docs/token-persistence.md covering:
  • Storage strategy (localStorage key, shape, serialization)
  • Full data lifecycle (register → setAuth → hydration → getMe → logout)
  • Me endpoint integration contract
  • Edge case table (corrupted storage, expired token, deleted user, multi-tab)

Closes #605 — token persistence: add regression coverage (S1-081)

• Created auth-context.test.tsx with 5 regression tests:
  • Logged-out state when localStorage is empty
  • Hydration from localStorage on mount
  • Graceful handling of corrupted localStorage data
  • setAuth persists to localStorage and updates React context
  • logout removes from localStorage and clears context

Files Changed

File	Change
apps/web/src/lib/api-client.ts	Added getMe() + getJson() helper
apps/web/src/lib/tests/auth-context.test.tsx	New — 5 token persistence tests
apps/docs/token-persistence.md	New — scope, contracts, integration docs
apps/docs/me-endpoint.md	Updated: web integration is now wired
apps/api/src/modules/auth/tests/me.test.ts	Added 404 NOT_FOUND edge case test
apps/api/src/modules/auth/tests/auth-errors.test.ts	Fixed JWT_SECRET fallback
apps/api/src/modules/auth/tests/auth-guard.test.ts	Fixed JWT_SECRET fallback
apps/api/src/shared/middleware/error.middleware.ts	Fixed missing LogContext crash

Verification

• ✅ Web tests: 19/19 pass (3 files)
• ✅ API tests: 57/57 pass (10 files)
• ✅ Shared package tests: 5/5 pass (1 file)