feat: add Go current-session HTTP adapter

backend/README.md

@@ -11,7 +11,7 @@ Implemented Modules:
   account, organization, role, and `sessionVersion` authorization.
 - `postgres`: fail-closed configuration, verified-CA TLS, readiness, and calls
   to the existing atomic claim and wallet PostgreSQL functions.
-- `httpapi`: process health and database readiness handlers.
+- `httpapi`: process health, database readiness, and current-session handlers.
 - `application`: composition and the `cmd/zhinian-api` process entry point.
 
 From the repository root:
@@ -31,9 +31,10 @@ server, use a different port:
 ZHINIAN_DATA_BACKEND=local GO_BACKEND_PORT=8080 ./backend/zhinian-api
 ```
 
-Only `/api/health` and `/api/ready` are implemented in this foundation. No
-Ingress, Docker, ACK, Secret, or Worker ownership has moved to Go yet.
+`/api/health`, `/api/ready`, and `/api/auth/me` are implemented in the local Go
+process. No Ingress, Docker, ACK, Secret, or Worker ownership has moved to Go
+yet, so Next.js remains the production owner of every route.
 
-The Identity resolver and PostgreSQL authorization-snapshot Adapter are
-implemented and tested, but no Go login or current-user HTTP route is exposed
-yet. Route ownership remains with Next.js until a later path-level cutover.
+The current-session handler reuses the Identity resolver and PostgreSQL
+authorization-snapshot Adapter, but login, logout, password mutation, and
+production route ownership remain with Next.js until later path-level cutover.