fix(auth): Return 403 when an authenticated actor has no user record

[nfebe]

GET /users/me answers 401 whenever the authenticated actor carries no user record (internal/api/users.go:181). Three actors the agent builds itself land there: anonymous when auth is disabled (internal/auth/middleware.go:46), legacy_key for a config-file API key (internal/auth/middleware.go:181), and a JWT minted without a user ID, which is what the config-API-key login path issues through GenerateJWT("api-user") (internal/auth/middleware.go:469). All three carry a credential the agent accepted and resolve to RoleAdmin, so 401 misstates what happened: authentication succeeded, there is simply no user record to describe. PUT /users/me and PUT /users/me/password return the same code from the same check (internal/api/users.go:199, :228).

A caller cannot separate that from a rejected credential, and the two have opposite recovery paths. The panel reads any 401 as the session ending, so it drops the stored token and returns to the login screen; because it reads the current user on every dashboard mount, signing in with a config-file API key logs the operator straight back out.

Checklist

• Return 403 from the three /users/me handlers when the actor authenticated but has no user record, leaving 401 for a credential the agent did not accept.
• Decide whether an admin-role actor with no user record should be served its own role and permissions rather than an error, which is what the caller is asking for.
• Add coverage for the anonymous, legacy key, and user-less JWT actors against these endpoints. Nothing exercises them today.
• Once this is in a release, remove the workaround in flatrun/ui that holds /users/me outside the session gate.

Related

• Part of group(enhancements): Albacore #158