feat(auth): implement GET /auth/me for NPM forward auth

Add endpoint to get current user profile from NPM forward auth headers.
Enables web authentication flow where NPM handles Authentik login.

- Read X-authentik-* headers set by NPM forward auth
- Auto-create user if not in database (first login via web)
- Sync roles from current Authentik groups
- Add get_user_by_email and get_user_by_authentik_id helpers

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/auth/service.py

@@ -86,6 +86,42 @@ class AuthService:
             logger.error(f"Authentik userinfo request error: {e}")
             raise ValueError("Authentication service unavailable")
 
+    async def get_user_by_email(self, email: str) -> Optional[User]:
+        """
+        Get user by email address
+
+        Args:
+            email: User email address
+
+        Returns:
+            User if found, None otherwise
+        """
+        stmt = (
+            select(User)
+            .options(selectinload(User.roles), selectinload(User.preferences))
+            .where(User.email == email)
+        )
+        result = await self.session.execute(stmt)
+        return result.scalar_one_or_none()
+
+    async def get_user_by_authentik_id(self, authentik_id: uuid.UUID) -> Optional[User]:
+        """
+        Get user by Authentik UUID
+
+        Args:
+            authentik_id: Authentik user UUID
+
+        Returns:
+            User if found, None otherwise
+        """
+        stmt = (
+            select(User)
+            .options(selectinload(User.roles), selectinload(User.preferences))
+            .where(User.authentik_id == authentik_id)
+        )
+        result = await self.session.execute(stmt)
+        return result.scalar_one_or_none()
+
     async def sync_user(self, token_info: TokenInfoSchema) -> tuple[User, bool]:
         """
         Create or update user from OIDC token info