wip(db): async call-site conversion in progress (Phase 3) — DO NOT MERGE yet

On the db-migration branch only; master stays clean + deployable. Foundation
(adapter, pg schema, smoke harness) is already on master and safe.

Done:
- repos.js fully async (Phase 2, validated: node --check clean, no missed transforms).
- session.js currentUser/apiKeyFromReq async.
- Mechanical `await` prefix applied across routes/static/calls/signaling/reminders/
  webhooks/push.

Remaining (does NOT compile yet — deterministic to finish):
1. Async cascade: helper fns that now contain `await` must be marked async and their
   callers awaited. node --check points to each (namesFor, authAttachmentRaw/
   authAttachment in static, the WS handlers in calls/signaling, reminders/webhooks
   loops).
2. DTO builders are the real work: namesFor, avatarsFor, buildPollDTO, buildMsgDTO,
   recDTO all became async — every `.map(x => buildMsgDTO(...))` etc. must become
   `await Promise.all(arr.map(async x => ...))`.
3. Chained calls `R.x.y(...).map/.length/.includes` → `(await R.x.y(...)).method`.
4. Then: node --check all green → node test/db-smoke.js green → e2e → merge to master.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/session.js

@@ -25,27 +25,28 @@ function tokenFromReq(req) {
 }
 
 // Resolve the logged-in user from the request. Returns user row (with mfa state) or null.
-function currentUser(req, { requireMfa = true } = {}) {
+// Async: the repos it reads go through the DB adapter, so every caller must `await currentUser(...)`.
+async function currentUser(req, { requireMfa = true } = {}) {
   const tok = tokenFromReq(req);
   if (!tok) return null;
-  const s = R.authSessions.byToken(tok);
+  const s = await R.authSessions.byToken(tok);
   if (!s || s.expires_at < now()) return null;
   if (requireMfa && !s.mfa_passed) return null;
-  const u = R.users.byId(s.user_id);
+  const u = await R.users.byId(s.user_id);
   if (!u || u.active === 0) return null;
   return { ...u, _session: s };
 }
 
 // Resolve a third-party API key from `X-API-Key` or `Authorization: Bearer bzc_...`.
 // Returns { id, teamId, scopes:[], name } or null. Keys are prefixed `bzc_` and stored hashed.
-function apiKeyFromReq(req) {
+async function apiKeyFromReq(req) {
   let raw = req.headers && req.headers['x-api-key'];
   if (!raw) {
     const h = req.headers && (req.headers.authorization || req.headers.Authorization);
     if (h && /^Bearer\s+bzc_/i.test(h)) raw = h.replace(/^Bearer\s+/i, '').trim();
   }
   if (!raw || !/^bzc_/.test(raw)) return null;
-  const row = R.apiKeys.byHash(A.hashToken(raw));
+  const row = await R.apiKeys.byHash(A.hashToken(raw));
   if (!row || row.revoked) return null;
   return { id: row.id, teamId: row.team_id, scopes: String(row.scopes || '').split(',').map((s) => s.trim()).filter(Boolean), name: row.name };
 }