Store Google avatar bytes and slim the session JWT to id only.

Download profile images on login into picturebinary, return them as base64 from /auth/me, and resolve sessions via getById.

src/api/routes/auth/selectedCompany.js

@@ -67,14 +67,13 @@ export function register(app, basePath = '') {
 
         try {
             await db.setSelectedCompany(req.user.id, companyId);
-            clearCachedUser(req.user.email);
+            clearCachedUser(req.user.id);
 
             const updated = await db.getAllowedEmail(req.user.email);
             const user = {
                 id: updated.id,
                 email: updated.email,
                 selectedCompanyId: updated.selectedCompanyId,
-                ...(req.user.picture && { picture: req.user.picture }),
             };
 
             res.status(200).json({ user });