refactor(260607-l6l): extract shared deriveDisplayName helper (BUG 2 DRY)

The displayName claim-preference logic (name → preferred_username → email →
sub fallback) was duplicated verbatim in me.ts and events.ts resolveUserId.
Extract it to auth/user.ts as deriveDisplayName and use it in both call sites,
so the rule has one definition. Update the events.test.ts user.js mock to keep
the real helper (spread importActual) while stubbing only upsertUser.

apps/api/tests/routes/events.test.ts

@@ -49,10 +49,16 @@ vi.mock('@hono/oidc-auth', () => ({
 
 // Mock upsertUser for the OIDC path — CR-06 tests override mockUpsertUser.fn.
 const mockUpsertUserFn = vi.fn()
-vi.mock('../../src/auth/user.js', () => ({
-  upsertUser: (...args: unknown[]) => mockUpsertUserFn(...args),
-  COLOR_PALETTE: ['#4A90D9', '#E8734A', '#5BA85A', '#9B6DC5', '#E8A840', '#3AAFA9'],
-}))
+vi.mock('../../src/auth/user.js', async (importActual) => {
+  // Keep deriveDisplayName (a pure helper) real so the displayName the handler
+  // passes to upsertUser reflects production claim-preference logic; stub only
+  // upsertUser (the DB-touching function).
+  const actual = await importActual<typeof import('../../src/auth/user.js')>()
+  return {
+    ...actual,
+    upsertUser: (...args: unknown[]) => mockUpsertUserFn(...args),
+  }
+})
 
 // ---------------------------------------------------------------------------
 // Configurable mock for the DB.