fix(auth): add user id to POST /auth response