Add display_name (unique) and email_confirmed_at columns plus matching getters, DTO fields, repo methods (findByDisplayName, update), and migration. Existing auth tests updated to construct User with the new params.
4 cases: missing auth_token cookie -> 401 json {error: unauthenticated}; unknown token -> 401; expired token -> 401 + repo cleanup; valid token -> 200 with the User attached to request->attributes['user']. fails red - middleware class absent.