Rework user types: create AuthenticatedUser and AnonymousUser class

Both are subclasses of an abstract User class which contains almost everything
interesting.

express/auth/types.ts

@@ -64,17 +64,17 @@ export const tokenLifetimes: Record<TokenType, number> = {
 };
 
 // Import here to avoid circular dependency at module load time
-import { AnonymousUser, type MaybeUser } from "../user";
+import type { User } from "../user";
 
 // Session wrapper class providing a consistent interface for handlers.
 // Always present on Call (never null), but may represent an anonymous session.
 export class Session {
     constructor(
         private readonly data: SessionData | null,
-        private readonly user: MaybeUser,
+        private readonly user: User,
     ) {}
 
-    getUser(): MaybeUser {
+    getUser(): User {
         return this.user;
     }
 
@@ -83,7 +83,7 @@ export class Session {
     }
 
     isAuthenticated(): boolean {
-        return this.user !== AnonymousUser;
+        return !this.user.isAnonymous();
     }
 
     get tokenId(): string | undefined {