fix(auth): correct endpoint path /auth/me → /auth/users/me

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/core/auth/auth_datasource.dart

@@ -102,7 +102,7 @@ class AuthDatasource {
   /// Returns user profile if authenticated via the proxy.
   /// Throws 401 if not authenticated or accessing directly.
   Future<AuthSyncResponse> getCurrentUser() async {
-    final response = await _dio.get<Map<String, dynamic>>('/auth/me');
+    final response = await _dio.get<Map<String, dynamic>>('/auth/users/me');
     return AuthSyncResponse.fromJson(response.data!);
   }
 

lib/core/auth/auth_provider.dart

@@ -21,7 +21,7 @@ part 'auth_provider.g.dart';
 /// - **Web**: NPM forward auth with Authentik (cookies handled by proxy)
 /// - **Mobile**: OIDC Authorization Code flow with flutter_appauth
 ///
-/// On web, the app calls GET /auth/me to check if user is authenticated
+/// On web, the app calls GET /auth/users/me to check if user is authenticated
 /// via NPM forward auth headers. On mobile, uses OIDC flow then POST /auth/sync.
 @riverpod
 class AuthNotifier extends _$AuthNotifier {
@@ -59,7 +59,7 @@ class AuthNotifier extends _$AuthNotifier {
   /// Returns AuthState if authenticated, null if not.
   Future<AuthState?> _tryWebAuth() async {
     try {
-      developer.log('Attempting web auth via /auth/me', name: 'auth');
+      developer.log('Attempting web auth via /auth/users/me', name: 'auth');
       final authDatasource = ref.read(authDatasourceProvider);
       final syncResponse = await authDatasource.getCurrentUser();
 
@@ -238,7 +238,7 @@ class AuthNotifier extends _$AuthNotifier {
     // User needs to access via the authenticated proxy URL
     if (kIsWeb) {
       developer.log('Web sign-in: user should access via authenticated proxy', name: 'auth');
-      // Try to refresh auth state from /auth/me
+      // Try to refresh auth state from /auth/users/me
       state = const AsyncLoading();
       final webAuth = await _tryWebAuth();
       if (webAuth != null) {