### Who am I, and what may I do

`GET /api/v1/auth/me`

The one-shot bootstrap call: the current manager, their roles, the resolved permission codes, and the tenant settings a client needs before it can render anything. Authenticated but not permission-gated, so any working credential reaches it.

- Authentication: manager session (JWT) or API token

#### Response — 200 OK

```json
{
  "data": {
    "version": "0.2.34",
    "manager": {
      "id": 41,
      "tenant_id": 12,
      "email": "ops@acme.example",
      "username": "ops",
      "status": "active",
      "two_factor_enabled": true
    },
    "roles": ["support"],
    "permissions": ["prm_users_index", "prm_users_update"],
    "is_admin": false,
    "settings": {
      "currency": "EGP",
      "timezone": "Africa/Cairo",
      "default_language": "en",
      "pos_undo_window_seconds": 60
    },
    "tenant": {
      "license_status": "active",
      "license_expires_at": "2027-01-31 00:00:00",
      "max_users": 5000,
      "users_count": 812,
      "blocked": false,
      "blocked_reason": ""
    }
  }
}
```

#### Note

For an API token, permissions is the INTERSECTION of the token's scope with its owner's live permissions, and is_admin is forced to false even when the owner is a tenant administrator. That is the authoritative answer to what the credential may do — gate your client on this array, not on the owner's role names. max_users null means unlimited; 0 means blocked, not unlimited.