Use session.user.id instead of email for profile lookups

[Copilot]

The profile API was using session.user.email as the Prisma lookup/update key — a mutable, session-updatable field — creating a potential cross-user access vector.

Changes

• app/api/user/profile/route.ts: Switch both GET and PATCH handlers to use session.user.id (immutable JWT primary key) for all findUnique/update calls
• Tighten auth guard to explicitly reject requests where session.user.id is absent, preventing undefined from reaching the Prisma where clause

// Before
where: { email: session.user?.email || undefined }

// After
if (!session || !session.user?.id) return new Response("Unauthorized", { status: 401 });
// ...
where: { id: session.user.id }

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.