Show the signed-in user in whoami from /v1/me

CHANGELOG.md

@@ -54,6 +54,11 @@ commands, `--json` output and exit codes. Each release's notes start with its se
   `portfolio` and `credential_scopes` fields, null when the API cannot be read; the exit code does
   not depend on that call.
   ([#48](https://github.com/Hodeitek/hodeishield-cli/issues/48))
+- `whoami` shows the signed-in user (`Name <email>`, in the `User` line and the `--json` `user`
+  string) from `GET /v1/me` when the API provides it for a sign-in, with no extra call. The
+  authorization server's userinfo endpoint stays as the fallback; a key still shows no user, and
+  nothing changes while the API does not send one.
+  ([#182](https://github.com/Hodeitek/hodeishield-cli/issues/182))
 
 ### Fixed
 

README.md

@@ -302,7 +302,8 @@ When `HODEISHIELD_API_KEY` is set it is used for every call, whatever else is co
 your CI's secret store; the CLI never prints it.
 
 `whoami` asks the API who the credential is and shows the tenant it reads (name and id), its
-organisation and, for a key, its scopes; for a portfolio key, the MSSP and how many client tenants it
+organisation and, for a key, its scopes; for a sign-in, also the signed-in user when the service
+provides it; for a portfolio key, the MSSP and how many client tenants it
 can select. With `--json` these are the `tenant`, `organization`, `portfolio` and
 `credential_scopes` fields. If the API cannot be reached, `whoami` still shows the local settings,
 leaves those fields null and says why on standard error.