feat(07-07): replay the 15 user-api routes and both nuxt auth flows

Match PHP payloads, already-activated Winter 500 HTML, and direct-DB
seeding so the corpus can flip those routes to ported without onboarding.

Co-authored-by: Cursor <cursoragent@cursor.com>

session_test.go

@@ -80,7 +80,7 @@ func TestLogin(t *testing.T) {
 	if userBody["email"] != user.Email || userBody["feedback_widget_hidden"] != false {
 		t.Fatalf("user payload = %#v", userBody)
 	}
-	if _, ok := userBody["permissions"].([]any); !ok {
+	if userBody["permissions"] != nil {
 		t.Fatalf("permissions = %#v", userBody["permissions"])
 	}