Fix auth/me returning nulls — auth endpoint was in public list

The auth endpoint was added to the public (no-auth) list so $currentUser
was never set. The me action now calls Auth::check() itself so it
validates the session cookie and returns the real user data.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

panel/api/endpoints/auth.php

@@ -31,13 +31,16 @@ match ($action) {
         Response::success(null, 'Logged out');
     })(),
 
-    'me' => (function() use ($currentUser) {
+    'me' => (function() {
+        $auth = Auth::getInstance();
+        if (!$auth->check()) Response::error('Unauthorized', 401);
+        $u = $auth->user();
         Response::success([
-            'id'       => $currentUser['uid'],
-            'username' => $currentUser['username'],
-            'email'    => $currentUser['email'],
-            'role'     => $currentUser['role'],
-            'theme'    => $currentUser['theme'],
+            'id'       => $u['uid'] ?? $u['id'],
+            'username' => $u['username'],
+            'email'    => $u['email'],
+            'role'     => $u['role'],
+            'theme'    => $u['theme'],
         ]);
     })(),