fix(auth): resolve session user by token subject ID

[pedroccastro]

What does this PR do?

Updates session user resolution to use the token subject (sub) for user lookup instead of email. This aligns the implementation with the immutable token identifier pattern and improves consistency in session handling.

Changes

• Changed user lookup in getServerSession from email-based to ID-based query
• Added validation for token subject before database lookup
• Updated logging to warn on invalid or missing user ID in token

How to test

1. Login with any account
2. Navigate through the app → session should work normally
3. Change email via Settings → Profile → Email change flow should work
4. Run unit tests: yarn test

Mandatory Tasks

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• N/A I have updated the developer docs in /docs if this PR makes changes that would require a documentation change.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
cal	Ignored		Jan 2, 2026 4:15pm
cal-companion	Ignored	Preview	Jan 2, 2026 4:15pm
cal-eu	Ignored		Jan 2, 2026 4:15pm

[cubic-dev-ai]

No issues found across 3 files