Fix input validation, type safety, and missing config files in apps/me

[Copilot]

Several bugs in the apps/me API routes allowed malformed requests to slip through or throw unexpectedly, and UserUpsert.meta was typed inconsistently with the actual DB schema.

Validation fixes

Falsy checks (!body.orgId) incorrectly reject 0 as an invalid ID. Replaced with explicit null/undefined + typeof guards in both the roles and positions routes:

// Before — rejects orgId: 0
if (!body.orgId || !body.roleName) { ... }

// After — only rejects missing/non-numeric values
if (body.orgId == null || typeof body.orgId !== "number" || !body.roleName) { ... }

Avatar route type safety

formData.get("file") can return a string. The unsafe as File | null cast would propagate to file.type/file.arrayBuffer() and throw. Replaced with an instanceof File guard returning a 400 on mismatch. Also corrected the error message which still referenced gif after it was removed from ALLOWED_TYPES.

UserUpsert.meta type alignment

meta was typed as string in UserUpsert but used as Record<string, unknown> everywhere else (merging, serializing, DB JSON column). Changed to Record<string, unknown> to match the actual contract.

Missing config files

Added .nvmrc, .firebaserc, and .env.firebase.example under apps/me/ — these were referenced in the README but absent from the repo.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.