Phase 2: onboarding wizard + custom-instructions endpoint

Adds the post-signup onboarding flow. The wizard collects display
name, office, jurisdictions, services (practice areas), sectors, an
optional "other" practice area, and the AI-use disclaimer
acknowledgement.

Middleware now redirects authenticated users with onboarded === false
to /onboarding for any non-public route, except /onboarding itself
and /api/session-token (which the wizard needs to mint backend
bearers). Once the wizard succeeds it calls
useSession().update({ onboarded: true }) so the session JWT picks up
the flag without a sign-out.

Backend new router /me with four endpoints:

  GET  /me                    Current user payload.
  GET  /me/onboarding-options offices, jurisdictions, services,
                              sectors from org_settings (active
                              entries only, sorted by order).
  POST /me/onboarding         Atomic submit: validates inputs,
                              filters unknown ids against the org
                              canonical lists, fails closed if
                              required axes are empty, writes all
                              profile fields plus onboarded_at and
                              ai_disclaimer_at, emits
                              user.onboarding.complete audit event.
  PATCH /me                   Partial post-onboarding updates,
                              including custom_instructions (capped
                              at 4096 chars).

Verified end-to-end against Postgres 16:
- GET /me reports onboarded=false before, true after.
- Disclaimer not acknowledged returns 400.
- Bad office id returns 400.
- All-unknown jurisdiction filters to empty and returns 400.
- Valid submit writes office, jurisdictions, services, sectors,
  practice_areas_other; sets onboarded_at and ai_disclaimer_at; and
  records audit event with metadata counts.
- PATCH /me applies custom_instructions and is visible on next GET.

The custom-instructions account-settings UI lands in a follow-up.
The org-level system prompt assembly (org + workspace + user) lands
in Phase 4 alongside the admin AI Policy page.