Persist Google picture and sub on login via setProfile.

Store profile fields from the verified ID token and read picture from the DB on authenticated requests.

src/api/middleware/auth.js

@@ -76,7 +76,7 @@ export const authMiddleware = async (req, res, next) => {
             id: user.id,
             email: user.email,
             selectedCompanyId: user.selectedCompanyId,
-            ...(decoded.picture && { picture: decoded.picture }),
+            ...(user.picture && { picture: user.picture }),
         };
 
         const now = Math.floor(Date.now() / 1000);