[BUG] Full user record is getting attached req.user

### Browser

Chrome

### Area

Auth (login / Google sign-in)

### Steps to reproduce

1. Check the `attachUser` function in `auth.js` middleware.
2. Notice that it finds user based on userId provided by cookie and attaches the whole user object from database to req.user
3. Login using `/dev-login` so that splitt cookie is set and access any route protected by requireAuth.
4. The `/me` route selects particular data from `req.user` but full user data is still available for downstream routes/controllers.
5. If suppose a downstream route directly returns `req.user`, then the sensitive fields might be exposed accidently.

### Expected behavior

The `auth.js` middleware should only attach safe user fields to `req.user` object.

### What actually happened

The `auth.js` middleware attaches the whole user object from the database to 'req.user', as `Prisma findUnique()` returns the whole object.

### Logs / Screenshots

_No response_