feat(auth): add /auth/me direct route and me GET action

- handlers/auth/proxy.go: new MeHandler proxies GET /auth/me to the
  shared auth service (boot revalidation for direct-mode clients).
- main.go: register /auth/me.
- actions/auth.go: Me proxies GET /action/me; Logout is method-aware
  (POST revokes via {refreshToken}, GET stays a bodyless no-op).
- action dispatcher: GET case me, POST case logout.
- go build + go vet clean.

src/actions/auth.go

@@ -35,13 +35,27 @@ func Register(w http.ResponseWriter, r *http.Request, payload interface{}) {
 	authproxy.ProxyPayload(w, r, "register", payload)
 }
 
-// Logout proxies the GET action variant to /auth/logout (forwarded bodyless;
-// the auth service keeps GET a no-op).
+// Logout proxies the logout action: POST forwards {refreshToken} so the auth
+// service revokes the session (M5 client logout); GET stays a bodyless no-op
+// for the legacy transition.
 func Logout(w http.ResponseWriter, r *http.Request, payload interface{}) {
+	if r.Method == http.MethodPost {
+		Debug("logout", "POST", "proxying to auth service")
+		authproxy.ProxyPayload(w, r, "logout", payload)
+		return
+	}
 	Debug("logout", "GET", "proxying to auth service")
 	authproxy.ProxyEmpty(w, r, "logout")
 }
 
+// Me proxies the GET action variant to /auth/me. The X-Access-Token header is
+// forwarded unchanged so the auth service resolves the caller (boot
+// revalidation, M5).
+func Me(w http.ResponseWriter, r *http.Request) {
+	Debug("me", "GET", "proxying to auth service")
+	authproxy.Proxy(w, r, "me")
+}
+
 // Refresh proxies the Maestro-mode refresh action (M5 auto-refresh path).
 func Refresh(w http.ResponseWriter, r *http.Request, payload interface{}) {
 	Debug("refresh", "POST", "proxying to auth service")

src/handlers/actions/action__actionName_.go

@@ -21,6 +21,8 @@ func ActionActionNameGet(w http.ResponseWriter, r *http.Request, params map[stri
 		actions.GetNote(w, r)
 	case "logout":
 		actions.Logout(w, r, nil)
+	case "me":
+		actions.Me(w, r)
 	default:
 		actions.Warn(action, "GET", "not implemented")
 		http.Error(w, "Action not implemented", http.StatusNotImplemented)
@@ -54,6 +56,8 @@ func ActionActionNamePost(w http.ResponseWriter, r *http.Request, params map[str
 		actions.Refresh(w, r, req.Payload)
 	case "delete":
 		actions.Delete(w, r, req.Payload)
+	case "logout":
+		actions.Logout(w, r, req.Payload)
 	default:
 		actions.Warn(action, "POST", "not implemented")
 		http.Error(w, "Action not implemented", http.StatusNotImplemented)

src/handlers/auth/proxy.go

@@ -57,6 +57,14 @@ func RefreshHandler() http.HandlerFunc {
 	}
 }
 
+// MeHandler proxies GET /auth/me; the X-Access-Token header is forwarded
+// unchanged so the auth service resolves the caller (boot revalidation, M5).
+func MeHandler() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		authproxy.Proxy(w, r, "me")
+	}
+}
+
 // DeleteHandler proxies POST /auth/delete {password}; the X-Access-Token
 // header is forwarded unchanged by the proxy.
 func DeleteHandler() http.HandlerFunc {

src/main.go

@@ -39,6 +39,7 @@ func main() {
 	mux.HandleFunc("/auth/register", auth.RegisterHandler())
 	mux.HandleFunc("/auth/logout", auth.LogoutHandler())
 	mux.HandleFunc("/auth/refresh", auth.RefreshHandler())
+	mux.HandleFunc("/auth/me", auth.MeHandler())
 	mux.HandleFunc("/auth/delete", auth.DeleteHandler())
 
 	mux.HandleFunc("/action/", func(w http.ResponseWriter, r *http.Request) {