fix: resolve user dashboard field mapping and session consistency

Added JSON tags to the User struct to match frontend expectations and excluded sensitive fields.
Updated session management to include and persist DisplayName.
Unified user field names (using display_name) across backend, sessions, and frontend UI.

internal/db/db.go

@@ -244,13 +244,13 @@ type ModelConfig struct {
 }
 
 type User struct {
-	ID                 int       `db:"id"`
-	Username           string    `db:"username"`
-	PasswordHash       string    `db:"password_hash"`
-	DisplayName        *string   `db:"display_name"`
-	Role               string    `db:"role"`
-	MustChangePassword bool      `db:"must_change_password"`
-	CreatedAt          time.Time `db:"created_at"`
+	ID                 int       `db:"id" json:"id"`
+	Username           string    `db:"username" json:"username"`
+	PasswordHash       string    `db:"password_hash" json:"-"`
+	DisplayName        *string   `db:"display_name" json:"display_name"`
+	Role               string    `db:"role" json:"role"`
+	MustChangePassword bool      `db:"must_change_password" json:"must_change_password"`
+	CreatedAt          time.Time `db:"created_at" json:"created_at"`
 }
 
 type ClientToken struct {