Problem: the dashboard SPA never checks for a session — the stx dev server serves /dashboard pages ungated (the API server's requireAuth only covers its own route), so anyone sees the project hub. The header has a logout icon but never shows who is signed in; the profile/password/email APIs have no UI.
Scope: dashboard layout boot calls GET /api/auth/me (credentialed) → 401 → redirect /login (works on both servers); header shows the signed-in email with a small menu (account settings, logout); minimal account page using the existing profile/password/email endpoints.
Done when: /dashboard without a session always lands on /login, and a signed-in user can see + manage their account.