Fix usage tracker to read user from session

🐛 Critical Fix:
- Usage tracker was only reading user from request.state.user
- After removing auth middleware, this was always None
- Now usage tracker also checks request.session for user data
- This should fix 'anonymous' user tracking after successful login

This was the root cause of users appearing as anonymous
even after successful OAuth authentication.

backend/middleware/usage_tracker.py

@@ -45,8 +45,13 @@ class UsageTrackingMiddleware(BaseHTTPMiddleware):
         """Track API usage and log user activity."""
         start_time = time.time()
         
-        # Get user info from request state (set by auth middleware)
+        # Get user info from request state (set by auth middleware) or session
         user = getattr(request.state, "user", None)
+        if not user:
+            try:
+                user = request.session.get("user")
+            except (AttributeError, AssertionError):
+                user = None
         user_id = user.get("username", "anonymous") if user else "anonymous"
         user_auth_method = user.get("auth_method", "none") if user else "none"