Refactor: single source of truth for lean board normalization

[RodriSanchez1]

Context

The transform "lean board -> API shape" (_id -> id, drop __v) is currently duplicated across three call sites, which is what allowed getBoardsByIds to drift and leak __v (see #469 / #470):

• user.js mapLeanBoardIds (login, x2)
• board.js getBoardsByIds (inline)
• board.js getBoardsSync (inline, minimal { id, lastEdited } projection — intentional)

The hotfix (#470) patched the leak but did not deduplicate the logic. A partial extraction was already prototyped (a normalizeLeanBoards helper in api/helpers/board.js) and stashed to keep the hotfix minimal.

Goal

Have one definition of a board's API shape so the lean path and the Mongoose-document path (toJSON) can't diverge again.

Proposed approach

Extract a single pure function (e.g. toBoardApiShape(obj) / normalizeLeanBoards) into api/helpers/board.js and reuse it from:

1. getBoardsByIds and the two login paths in user.js.
2. The schema's toJSON transform in models/Board.js, so documents and lean objects share the exact same shaping logic.

Notes / decisions to make during implementation:

• getBoardsSync intentionally returns only { id, lastEdited }; decide whether it keeps its explicit inline map (preferred) or reuses the helper.
• If the toJSON transform drops __v itself, the versionKey: false option becomes redundant (can be kept as belt-and-suspenders).
• Watch the id virtual: with virtuals: true, ret already carries an id string; ensure the shared function does not double-set or clobber it inconsistently between the document and lean paths.

Notes

• Pure refactor: no API contract change (same JSON output).
• Add/extend tests for the login and /board/byids responses to lock the shape.
• Related: Board update fails with Mongoose VersionError after board sync #469, fix(board): avoid Mongoose VersionError on board update after sync #470.