getCurrentUser is wrapped in React cache so pages that call it from
several components validate the session once per request. Cross-request
caching ("use cache", unstable_cache, module-level storage) stays
forbidden for cleo data and sessions: the PHP app writes to the same DB,
and a cached session would keep a logged-out user signed in.
CLAUDE.md and the cleo-code-review skill now state both rules.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deardo Satria