Read session from Redis directly (same as /api/user-info), use forwardToApi for all service calls

Ya

29 Machi 2026, 20:20 UTC

Mwandishi

kamo

Ahadi ya

9e920c9

Root cause: the sender profile showed 'Your colleague' because the session fetch called a non-existent SecurityService endpoint. Signature was malformed because direct fetch to EmailService lacked OTK auth. Fixes: - Session: reads *** cookie → Redis directly (same as /api/user-info) - Member/org lookup: uses forwardToApi (generates fresh OTK per call) - Template fetch: uses forwardToApi through email proxy route - Email send: still goes directly to EmailService (proven working)