feat(client): return the account username with the Docker Hub session

[Benehiko]

Part of #682 (item 1).

GetDefaultSession already reads the default profile to find the account entry, but it threw the profile away. UserSession.Claims.Username is often empty. That forces callers such as Compose to call GetDefaultProfile a second time to get the username a registry credential needs.

This adds UserSession.Username:

• GetDefaultSession sets it to the default profile's username, or to the token's username claim if the profile has none.
• GetSession sets it to the requested username, which is the account entry key (docker/auth/hub/<username>).

The field is tagged json:"-" because the client fills it in; it is not read from the stored payload. Adding a struct field doesn't break callers, and the ClientAuth interface is unchanged. On the Compose side, the profile fallback becomes session.Username.

Details

Open questions

• Precedence. This PR checks the profile first, then the claim. Compose does the reverse. I chose the profile because the session is found through it and it is already loaded. In practice the two should match.
• Empty username. If neither the profile nor the claims has a username, GetDefaultSession still succeeds with Username == "", so callers that only need the token keep working. Two other options are left out for now: fall back to the last part of the profile's user_id (the account key), or return an error.

Out of scope: items 2–5 of #682 (expiry helper, ErrSessionExpired, an "unavailable" check, connecting to the Desktop socket). These can be separate PRs.

Testing: go test -race ./... and golangci-lint run in client/ (0 issues). New subtests cover each username source, the precedence, the empty case, and a top-level username in the stored payload being ignored. One test checks that GetDefaultSession does exactly one profile lookup and one session lookup.

AI usage: The code, tests and this description were drafted with alki, a coding agent built on Claude.

[docker-agent]

Assessment: 🟢 APPROVE

[Benehiko]

Closing: UserSession.Claims.Username already carries the username, so a second Username field is not needed. It was empty because Docker Desktop did not always parse the token claims; that is fixed, and a migration is underway to make it consistent. See #682.