feat(API): optional display name on users

test/user_response_field_hygiene_test.go

@@ -76,6 +76,7 @@ var forbiddenUserFieldKeys = []string{
 	"verification_code",
 	"verification_expiration",
 	"password_reset_expiration",
+	"token_version",
 }
 
 func assertNoForbiddenKeys(t *testing.T, body []byte) {
@@ -124,7 +125,7 @@ func TestUserResponseFieldHygiene(t *testing.T) {
 			t.Fatalf("failed to decode response: %v", err)
 		}
 
-		expectedKeys := []string{"id", "username", "email", "is_verified", "created_at", "updated_at"}
+		expectedKeys := []string{"id", "username", "email", "is_verified", "created_at", "updated_at", "display_name"}
 		if len(decoded) != len(expectedKeys) {
 			t.Errorf("expected exactly %d keys, got %d: %v", len(expectedKeys), len(decoded), decoded)
 		}
@@ -135,6 +136,11 @@ func TestUserResponseFieldHygiene(t *testing.T) {
 		}
 		assertNoForbiddenKeys(t, rec.Body.Bytes())
 
+		var displayName string
+		if err := json.Unmarshal(decoded["display_name"], &displayName); err != nil || displayName != "" {
+			t.Errorf("expected display_name to decode to an empty string, got %q (%v)", displayName, err)
+		}
+
 		var isVerified bool
 		if err := json.Unmarshal(decoded["is_verified"], &isVerified); err != nil {
 			t.Fatalf("failed to decode is_verified: %v", err)