feat(API): optional display name on users

features/user_response_field_hygiene.qa.md

@@ -21,10 +21,11 @@ Package: `test` (black-box), extending `test/account_verification_http_test.go`'
    user id 7. Decode the response body into `map[string]json.RawMessage` (not into `user.User`)
    and assert:
    - the key set is exactly `{"id", "username", "email", "is_verified", "created_at",
-     "updated_at"}`;
+     "updated_at", "display_name"}`;
    - none of `password`, `password_reset_code`, `verification_code`,
-     `verification_expiration`, `password_reset_expiration` is present;
-   - `is_verified` unmarshals to `true`.
+     `verification_expiration`, `password_reset_expiration`, `token_version` is present;
+   - `is_verified` unmarshals to `true`;
+   - `display_name` unmarshals to `""`.
 5. Rejected verify: same seed, `{"code":"wrong-code"}` → assert status `403` and that the raw
    response body bytes, treated as a string, contain none of the substrings `password`,
    `verification_code`, `password_reset_code`, `verification_expiration`,
@@ -55,6 +56,6 @@ Package: `test` (black-box), extending `test/account_verification_http_test.go`'
   render; confirm by hand that no SPA code reads `password`, `verification_code` or
   `password_reset_code` off the verify response, since removing them from the wire format could
   otherwise silently break a screen that isn't covered by this Go test suite.
-- Confirm the new response type lives in `api/handlers/auth` (not a change to
+- Confirm the public response type lives in the shared package under `api/pkg` (not a change to
   `internal/domain/user/userDomain.go`'s json tags), per the project's stated preference to keep
   the domain struct's tags intact and shape the public response in the handler layer instead.