validateSession now returns user data. Middleware sets event.locals.user on every authenticated request. Add /api/auth/oauth to public paths. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>