Sponsor shown on sign-in + new-member onboarding (username, optional profile)

- Sign-in page shows "You're joining the line of @X" when arriving via a sponsor
  link (/api/sponsor now returns the sponsor name + avatar).
- After a new account verifies (or signs up) with no username yet, an onboarding
  modal prompts for a username and an optional bio (both skippable), before the
  welcome tour.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server.js

@@ -350,7 +350,14 @@ const server = http.createServer(async (req, res) => {
     if (p === '/api/sponsor' && req.method === 'GET') {
       const tok = parseCookies(req)['iap.sponsor'] || '';
       const sponsorId = await resolveSponsorToken(tok);
-      return json(res, 200, { ref: tok, sponsorId, invited: !!tok });
+      let name = null, avatarUrl = null;
+      if (tok) {
+        const t = tok.toLowerCase();
+        let a = await accounts.byCode(t); if (!a) a = await accounts.byUsername(t);
+        if (!a && /^\d+$/.test(tok)) a = await accounts.byMemberId(Number(tok));
+        if (a) { name = a.username ? '@' + a.username : (a.memberId ? 'member #' + a.memberId : null); avatarUrl = a.avatarUrl || null; }
+      }
+      return json(res, 200, { ref: tok, sponsorId, invited: !!tok, name, avatarUrl });
     }
     if (p === '/api/stats' && req.method === 'GET') {
       let members = 0; try { members = await chain.memberCount(); } catch (e) {}
@@ -422,7 +429,7 @@ const server = http.createServer(async (req, res) => {
       let memberId = 0;
       if (r.account.address) { try { memberId = await chain.memberIdByAccount(r.account.address); } catch (err) {} }
       const token = await auth.mintSession({ email: r.account.email, address: r.account.address, memberId });
-      return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
+      return json(res, 200, { ok: true, account: r.account, created: !!r.created }, { 'Set-Cookie': auth.sessionCookie(token) });
     }
 
     // -- wallet auth: link-to-account when an email session exists, or