v4.1: Fix /api/me — Infinity → 999999 in JSON, add all capability flags

v3.0: Add /api/me route — returns user profile (plan, role, usage) from DB for client components