Store Google avatar bytes and slim the session JWT to id only.

Download profile images on login into picturebinary, return them as base64 from /auth/me, and resolve sessions via getById.

src/api/routes/company.js

@@ -2,12 +2,11 @@ import * as db from '../../db/company.js';
 import * as googleAuth from '../../db/googleAuth.js';
 import { clearCachedUser } from '../middleware/auth.js';
 
-function userPayload(req, authRow) {
+function userPayload(authRow) {
     return {
         id: authRow.id,
         email: authRow.email,
         selectedCompanyId: authRow.selectedCompanyId,
-        ...(req.user.picture && { picture: req.user.picture }),
     };
 }
 
@@ -151,9 +150,9 @@ export function register(app, basePath = '') {
         try {
             const company = await db.createCompany(req.user.id, body);
             await googleAuth.setSelectedCompany(req.user.id, company.id);
-            clearCachedUser(req.user.email);
+            clearCachedUser(req.user.id);
             const authRow = await googleAuth.getAllowedEmail(req.user.email);
-            res.status(201).json({ company, user: userPayload(req, authRow) });
+            res.status(201).json({ company, user: userPayload(authRow) });
         } catch (error) {
             const status = companyErrorStatus(error);
             if (status === 500) console.error('Create company failed:', error);