sec(api): Cache-Control: no-store on /auth/me

[mastermanas805]

Summary

• AUTH-146: /auth/me returns the caller's session-bound identity (user_id, team_id, email, tier, experiments-bucket, admin flags, impersonation state). Without Cache-Control: no-store, a service worker / browser back-cache / intermediate proxy could re-serve those values to a subsequent session — different user on the same machine, post-rotation token, post-impersonation drop.
• Stamp Cache-Control: no-store (RFC 9111 §5.2.2.5 — the only directive that forbids storing the response at all) before the JSON return.

Coverage block (rule 17)

Symptom:       /auth/me emits no Cache-Control hint
Enumeration:   rg -n 'cliAuthH\.GetCurrentUser|"/auth/me"' internal/
Sites found:   1 production handler (cli_auth.go:211)
Sites touched: 1 — c.Set("Cache-Control", "no-store") before c.JSON
Coverage test: TestAuthMe_CacheControlNoStore exercises the production
               wiring (RequireAuth + real JWT) so the no-store header
               is asserted in the real 200 path; tokens-tolerant
               (matches "no-store" as a directive in a comma-list)
               so a forward-compat directive list "no-store, no-cache,
               private" stays green.
Live verified: pending CI auto-deploy (rule 14 SHA check after merge).

Test plan

• go build ./... clean
• go vet ./... clean
• go test ./internal/handlers -run TestAuthMe all pass (existing + new)
• Live verify after merge: curl -i -H "Authorization: Bearer <pat>" https://api.instanode.dev/auth/me | grep -i 'cache-control'

Inbox: AUTH-146