Store Google avatar bytes and slim the session JWT to id only.

Download profile images on login into picturebinary, return them as base64 from /auth/me, and resolve sessions via getById.

src/api/routes/auth/me.js

@@ -1,4 +1,6 @@
 import { meJson } from '../../auth/meJson.js';
+import * as db from '../../../db/googleAuth.js';
+import { toPictureBuffer } from '../../../util/pictureBinary.js';
 
 /**
  * Registers the current-user route (requires prior auth middleware populating `req.user`).
@@ -12,7 +14,10 @@ export function register(app, basePath = '') {
      *   get:
      *     tags: [Auth]
      *     summary: Current user
-     *     description: Returns the authenticated user from the session cookie and the Google client ID. Unauthenticated calls still receive `googleClientId` with 401.
+     *     description: |
+     *       Returns the authenticated user from the session cookie and the Google client ID.
+     *       `user.picture` is the stored profile image as a base64 string when present.
+     *       Unauthenticated calls still receive `googleClientId` with 401.
      *     security:
      *       - cookieAuth: []
      *     x-markdown: auth/me.md
@@ -40,9 +45,24 @@ export function register(app, basePath = '') {
      *                 googleClientId:
      *                   type: string
      */
-    app.get(`${basePath}/auth/me`, (req, res) => {
-        const { id, email, selectedCompanyId, picture } = req.user;
-        const user = { id, email, selectedCompanyId, ...(picture && { picture }) };
-        meJson(res, 200, { user });
+    app.get(`${basePath}/auth/me`, async (req, res) => {
+        try {
+            const row = await db.getById(req.user.id);
+            if (!row) {
+                return meJson(res, 403, { error: 'User is no longer authorized' });
+            }
+
+            const pictureBinary = toPictureBuffer(row.pictureBinary);
+            const user = {
+                id: row.id,
+                email: row.email,
+                selectedCompanyId: row.selectedCompanyId,
+                ...(pictureBinary && { picture: pictureBinary.toString('base64') }),
+            };
+            meJson(res, 200, { user });
+        } catch (error) {
+            console.error('Get current user failed:', error);
+            meJson(res, 500, { error: 'Failed to load user' });
+        }
     });
 }