The /api/auth/refresh and /api/auth/me endpoints only returned did, handle, and crossPostScopesGranted. The frontend AuthSession type expects displayName and avatarUrl for rendering the user avatar in the header bar. Now both endpoints query the users table and include these fields, falling back to null when no profile data exists yet.