feat(#193): Align authentication mechanism between API and web client

- Update AuthUser type in @mosaic/shared to include workspace fields
- Update AuthGuard to support both cookie-based and Bearer token authentication
- Add /auth/session endpoint for session validation
- Install and configure cookie-parser middleware
- Update CurrentUser decorator to use shared AuthUser type
- Update tests for cookie and token authentication (20 tests passing)

This ensures consistent authentication handling across API and web client,
with proper type safety and support for both web browsers (cookies) and
API clients (Bearer tokens).

Fixes #193

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

packages/shared/src/types/auth.types.ts

@@ -13,6 +13,10 @@ export interface AuthUser {
   name: string;
   image?: string;
   emailVerified?: boolean;
+  // Workspace context (added for workspace-scoped operations)
+  workspaceId?: string;
+  currentWorkspaceId?: string;
+  workspaceRole?: string;
 }
 
 /**