fix(auth): include subscription in auth status for balance ring

Refresh/login previously dropped active subscription from the client user
payload, so paid users saw a 0% balance ring despite valid plan quota.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/portal-core-auth-routes.test.mjs

@@ -209,7 +209,7 @@ test('returns multi-user status and preserves capability projection', async () =
   assert.equal(res.statusCode, 200);
   assert.deepEqual(res.body, {
     authenticated: true,
-    user: { id: 'user-1', username: 'john' },
+    user: { id: 'user-1', username: 'john', subscription: null },
     mode: 'user',
     capabilities: ['chat'],
     grantedSkills: ['web'],
@@ -220,6 +220,24 @@ test('returns multi-user status and preserves capability projection', async () =
   });
 });
 
+test('includes active subscription in auth status user payload', async () => {
+  const setup = createSetup({
+    getSubscriptionService: () => ({
+      async getActiveSubscription(userId) {
+        assert.equal(userId, 'user-1');
+        return {
+          planType: 'pro',
+          periodTokensLimit: 100_000_000,
+          periodTokensUsed: 0,
+        };
+      },
+    }),
+  });
+  const res = await invoke(setup, 'get', '/auth/status');
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.body.user.subscription?.planType, 'pro');
+});
+
 test('preserves unavailable, legacy, and disabled status modes', async () => {
   const unavailable = createSetup({
     isDatabaseConfiguredFn: () => true,