fix(auth): point authMe at the real /user/me endpoint
The query asked for users/me, which the backend does not serve, so every
call 404'd and permission-derived UI (custom-page creation) silently fell
back to "no rights". Tagging the query lets permission changes invalidate it.