* fix(auth): align session user resolution with token subject * test(auth): add unit tests for getServerSession user resolution