feat(server): GET /auth/me/localization — tenant regional defaults for every user (#2122)

Phase 2a of unifying currency. The `localization` settings (currency/locale/
timezone) are gated to `setup.access`, and `discovery` is static/context-free —
so a regular user's client has no way to learn the tenant's default currency or
locale to format values consistently.

This adds `GET /api/v1/auth/me/localization`, returning the resolved
`{ currency, locale, timezone }` off the request ExecutionContext (the same
values #2119 wired in) to every AUTHENTICATED user — without the setup.access
gate on the underlying settings. A thin passthrough of `resolveCtx(c)`; the
ctx resolution itself is covered by resolve-execution-context tests.

Unblocks the objectui client (Phase 2): a LocalizationProvider can fetch this
once and feed a single currency/number formatter the tenant default + locale,
replacing ~20 ad-hoc per-site currency-resolution paths.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

.changeset/me-localization-endpoint.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/plugin-hono-server": minor
+---
+
+Expose resolved regional defaults to every authenticated user.
+
+Adds `GET /api/v1/auth/me/localization` returning the request tenant's resolved
+`{ currency, locale, timezone }` from the ExecutionContext (ADR-0053). The
+`localization` SETTINGS are gated to `setup.access`, but the resolved defaults
+are needed by every renderer to format currency/dates/numbers — so they are
+surfaced here without that gate. Enables a client to format a currency field
+in the tenant's default currency when the field omits its own.

packages/plugins/plugin-hono-server/src/hono-plugin.ts

@@ -718,6 +718,25 @@ export class HonoServerPlugin implements Plugin {
             }
         });
 
+        // GET /me/localization — the resolved regional defaults (currency /
+        // locale / timezone) for the current request's tenant, exposed to EVERY
+        // authenticated user. The `localization` SETTINGS are gated to
+        // `setup.access`, but the resolved defaults are needed by every renderer
+        // to format currency/dates/numbers — so they ride on the request
+        // ExecutionContext (ADR-0053) and are surfaced here without that gate.
+        rawApp.get(`${prefix}/auth/me/localization`, async (c: any) => {
+            const execCtx = await resolveCtx(c);
+            if (!execCtx?.userId) {
+                return c.json({ authenticated: false });
+            }
+            return c.json({
+                authenticated: true,
+                currency: execCtx.currency ?? null,
+                locale: execCtx.locale ?? null,
+                timezone: execCtx.timezone ?? null,
+            });
+        });
+
         // GET /me/apps — list apps the current user is allowed to enter.
         // Filters `metadata.list('app')` by:
         //   1. AppSchema.requiredPermissions ⊆ ctx.systemPermissions