feat(auth): add /auth/me direct route and me GET action

- handlers/auth/proxy.go: new MeHandler proxies GET /auth/me to the
  shared auth service (boot revalidation for direct-mode clients).
- main.go: register /auth/me.
- actions/auth.go: Me proxies GET /action/me; Logout is method-aware
  (POST revokes via {refreshToken}, GET stays a bodyless no-op).
- action dispatcher: GET case me, POST case logout.
- go build + go vet clean.

src/actions/auth.go

@@ -35,13 +35,27 @@ func Register(w http.ResponseWriter, r *http.Request, payload interface{}) {
 	authproxy.ProxyPayload(w, r, "register", payload)
 }
 
-// Logout proxies the GET action variant to /auth/logout (forwarded bodyless;
-// the auth service keeps GET a no-op).
+// Logout proxies the logout action: POST forwards {refreshToken} so the auth
+// service revokes the session (M5 client logout); GET stays a bodyless no-op
+// for the legacy transition.
 func Logout(w http.ResponseWriter, r *http.Request, payload interface{}) {
+	if r.Method == http.MethodPost {
+		Debug("logout", "POST", "proxying to auth service")
+		authproxy.ProxyPayload(w, r, "logout", payload)
+		return
+	}
 	Debug("logout", "GET", "proxying to auth service")
 	authproxy.ProxyEmpty(w, r, "logout")
 }
 
+// Me proxies the GET action variant to /auth/me. The X-Access-Token header is
+// forwarded unchanged so the auth service resolves the caller (boot
+// revalidation, M5).
+func Me(w http.ResponseWriter, r *http.Request) {
+	Debug("me", "GET", "proxying to auth service")
+	authproxy.Proxy(w, r, "me")
+}
+
 // Refresh proxies the Maestro-mode refresh action (M5 auto-refresh path).
 func Refresh(w http.ResponseWriter, r *http.Request, payload interface{}) {
 	Debug("refresh", "POST", "proxying to auth service")