feat: remote user, ack/done actions and /me API

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw

core/app/Http/Middleware/RemoteUser.php

@@ -2,14 +2,28 @@
 
 namespace App\Http\Middleware;
 
+use App\Ingest\EventUpserter;
 use Closure;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
 
+/**
+ * Доверяет X-Remote-User от Caddy forward_auth (сеть изолирована, как в sekai).
+ * На публичных маршрутах (/api, /a, /hooks) этот middleware не стоит.
+ */
 class RemoteUser
 {
+    public function __construct(private readonly EventUpserter $users) {}
+
     public function handle(Request $request, Closure $next): Response
     {
+        $login = trim((string) $request->header('X-Remote-User', ''));
+        if ($login === '') {
+            return response()->json(['message' => 'Нет X-Remote-User: запрос должен идти через хаб'], 401);
+        }
+
+        $request->attributes->set('user', $this->users->ensureUser($login));
+
         return $next($request);
     }
 }