Fix auth token being clobbered by game seat token (userId always null)

The login JWT and the per-seat rejoin token shared the localStorage key
'shelem_token', so joining a game overwrote the auth token with the random
seat token. The socket then reconnected as an unauthenticated guest, so every
seat was recorded with userId=null and no stats or history were attributed.

- Seat token now uses its own key 'shelem_seat_token'; 'shelem_token' is auth-only
- Add GET /api/me + boot-time validateAuth() to drop stale/corrupted tokens
  instead of running as a "logged in" ghost
- reauthSocket() re-authenticates the live socket on login/register

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server.js

@@ -136,6 +136,12 @@ app.get('/api/config', (_req, res) => {
   res.json({ signupsOpen: config.signupsOpen });
 });
 
+// Validate the stored auth token; the client uses this at startup to detect a
+// stale/corrupted token and drop the fake "logged in" state.
+app.get('/api/me', requireAuth, (req, res) => {
+  res.json({ id: req.user.id, username: req.user.username });
+});
+
 app.post('/api/register', (req, res) => {
   if (!config.signupsOpen)
     return res.status(403).json({ error: 'New registrations are currently closed.' });