fix: resolve user dashboard field mapping and session consistency

Added JSON tags to the User struct to match frontend expectations and excluded sensitive fields.
Updated session management to include and persist DisplayName.
Unified user field names (using display_name) across backend, sessions, and frontend UI.

internal/server/dashboard.go

@@ -83,25 +83,21 @@ func (s *Server) handleLogin(c *gin.Context) {
 		return
 	}
 
-	token, err := s.sessions.CreateSession(user.Username, user.Role)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, ErrorResponse("Failed to create session"))
-		return
-	}
-
 	displayName := user.Username
 	if user.DisplayName != nil {
 		displayName = *user.DisplayName
 	}
 
+	token, err := s.sessions.CreateSession(user.Username, displayName, user.Role)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse("Failed to create session"))
+		return
+	}
+
 	c.JSON(http.StatusOK, SuccessResponse(gin.H{
 		"token":                token,
 		"must_change_password": user.MustChangePassword,
-		"user": gin.H{
-			"username": user.Username,
-			"name":     displayName,
-			"role":     user.Role,
-		},
+		"user":                 user,
 	}))
 }
 
@@ -116,8 +112,9 @@ func (s *Server) handleAuthStatus(c *gin.Context) {
 	c.JSON(http.StatusOK, SuccessResponse(gin.H{
 		"authenticated": true,
 		"user": gin.H{
-			"username": session.Username,
-			"role":     session.Role,
+			"username":     session.Username,
+			"role":         session.Role,
+			"display_name": session.DisplayName,
 		},
 	}))
 }