fix(db): transactional useMagicToken, O(2) getSession, ?? for displayName

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/db.js

@@ -61,7 +61,7 @@ function initDb(dbPath) {
     const stmt = instance.prepare(
       'INSERT INTO profiles (email, display_name, created_at, last_seen) VALUES (?,?,?,?) RETURNING *'
     )
-    return stmt.get(email, displayName || null, now, now)
+    return stmt.get(email, displayName ?? null, now, now)
   }
 
   function findProfileByEmail(email) {
@@ -83,14 +83,14 @@ function initDb(dbPath) {
     )
   }
 
-  function useMagicToken(token) {
+  const useMagicToken = instance.transaction((token) => {
     const row = instance
       .prepare('SELECT * FROM magic_tokens WHERE token = ? AND used = 0 AND expires_at > ?')
       .get(token, Date.now())
     if (!row) return null
     instance.prepare('UPDATE magic_tokens SET used = 1 WHERE token = ?').run(token)
     return row.profile_id
-  }
+  })
 
   function createSession(token, profileId) {
     const now = Date.now()
@@ -102,8 +102,9 @@ function initDb(dbPath) {
   function getSession(token) {
     const row = instance.prepare('SELECT * FROM sessions WHERE token = ?').get(token)
     if (!row) return null
-    instance.prepare('UPDATE sessions SET last_seen = ? WHERE token = ?').run(Date.now(), token)
-    return instance.prepare('SELECT * FROM sessions WHERE token = ?').get(token)
+    const now = Date.now()
+    instance.prepare('UPDATE sessions SET last_seen = ? WHERE token = ?').run(now, token)
+    return { ...row, last_seen: now }
   }
 
   function deleteSession(token) {