bug: restrict User attributes exposed by GET /rest/memories

[devin-ai-integration]

Description

GET /rest/memories (unauthenticated) returned each memory with the fully-serialized associated User row, exposing password (MD5 hash), totpSecret, deluxeToken, email and lastLoginIp of every user who uploaded a memory.

getMemories() now includes UserModel with attributes: ['id', 'username'] — the only field the photo wall frontend consumes (memory.User?.username). An API test asserts the serialized User object contains exactly those keys.

Resolved or fixed issue: none

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: Devin
  • LLMs and versions: Devin (Cognition AI)
  • Prompts: Fix security finding: unauthenticated GET /rest/memories exposes all users' credentials via unrestricted UserModel include

Affirmation

• My code follows the CONTRIBUTING.md guidelines

Devin-Org: engineering

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.