fix(260607-l6l): derive displayName from OIDC claims in me.ts + resolveUserId

BUG 2: Both me.ts and events.ts resolveUserId were passing email (often
absent) as displayName to upsertUser, resulting in blank legend names.
Also, upsertUser returned existing rows unchanged even when displayName
was null and a better value was now available.

- me.ts: derive displayName via name → preferred_username → email →
  "Member <sub-prefix>" fallback, checked defensively. Updated JSDoc.
- events.ts resolveUserId: same derivation so write-path upserts don't
  re-blank a correctly-set displayName.
- user.ts: when existing row has null displayName and caller supplies one,
  issue an UPDATE so already-existing blank rows are corrected on next login.

Authelia-side emission of name/preferred_username is an operator concern
(claim mappings / userinfo scope in authelia config) — out of scope here.
The code now reads whatever claims are present and falls back sensibly.

apps/api/src/auth/user.ts

@@ -49,6 +49,15 @@ export async function upsertUser(
     .limit(1)
 
   if (existing[0]) {
+    // If the existing row has no displayName but the caller supplies one, update it now.
+    // This corrects rows created before robust claim derivation was in place (BUG 2 fix).
+    if (!existing[0].displayName && displayName) {
+      await db
+        .update(users)
+        .set({ displayName })
+        .where(eq(users.id, existing[0].id))
+      return { ...existing[0], displayName }
+    }
     return existing[0]
   }