fix(auth): encode snowflake user ids as strings in session and /user-info

Registered users get snowflake ids above JS MAX_SAFE_INTEGER.
/user-info emitted them as JSON numbers and login stored uint64 in
the session. Both now use decimal strings. Tests cover admin vs
non-admin cookie access to /user/self, /user-info, and /upload/my.

backend/plugins/domain/auth/session.go

@@ -128,7 +128,7 @@ func SetLoginSession(ctx context.Context, c *gin.Context, user *contracts.UserDT
 	session.Clear()
 	rotateSessionID(session)
 
-	session.Set(UserIDKey, user.ID)
+	session.Set(UserIDKey, strconv.FormatUint(user.ID, 10))
 	session.Set(UserNameKey, user.Username)
 	if len(extras) > 0 {
 		for key, value := range extras[0] {