fix(auth): resolve session user by token subject ID

[tomerqodo]

Benchmark PR from qodo-benchmark#290

---

Note

Improves server-side session resolution and adds coverage.

• Parse token.sub to userId, warn and return null if invalid; minor refactor to inline lowercased email in findUnique query
• New __mocks__/getServerSession.mocks.ts providing Prisma, logger, repositories, utilities, and token/user factories
• New getServerSession.test.ts with cases for token validation, user ID validation, user lookup/resolution via sub, session shape, and ensuring queries use id

^{Written by Cursor Bugbot for commit 04dcede. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

User lookup still uses email instead of ID

High Severity

The userId is parsed from token.sub and validated, but the database query at line 64-65 still looks up users by email instead of by id. The PR intends to resolve users by token subject ID, and the tests expect where: { id: userId }, but the implementation uses where: { email: token.email.toLowerCase() }. The computed userId variable is never used for its intended purpose.