Get the caller's own identity and workspaces

Same body as MCP's whoami: id, name, email, avatar, and the workspaces visible to the caller with the role held in each. A workspace-bound token sees only its audience. Bearer callers also receive token (name, kind, scope, workspace, expiresAt); sessions omit it. Use id for assigneeUserIds and a workspace slug for the ?workspace= parameter elsewhere — the only way to learn either without triggering a write error.