- Replace HMAC-signed cookie with AES-GCM encrypted JSON containing
both DID and handle, using HKDF key derivation
- Remove wrapCallXrpcWithScopeRedirect — no longer needed now that
SvelteKit form actions handle scope errors with redirect() directly
- Simplify getViewer() to sync globalThis read (no more async cookie
parsing or $app/server imports)
- Widen viewer type to { did, handle? } across XrpcContext and handlers
- Extract scopeMissingResponse() helper, replacing 5 duplicate blocks
- Set __hatk_viewer in production SSR path around renderPage
- Add client-side 401 redirect for query endpoints (not just procedures)
- Fix unused import/param lint warnings

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>