Returns the currently authenticated user’s basic info from the access token.
This endpoint does not refresh expired access tokens by itself.
For browser apps using the TypeScript SDK, call auth.getCurrentUser()
during startup. The SDK will use the httpOnly refresh cookie automatically
when it can refresh the session. Server, mobile, and other non-browser
clients should call /api/auth/refresh explicitly.