[Col0ring]

Summary

• register the request-cookie reader from auth.server instead of dynamically importing it inside the API client, so the client no longer depends on the server module
• detect the server by the absence of window rather than import.meta.env.SSR, so runs outside the bundler also attach the request cookie
• treat a missing Origin as an allowlist of the same-origin and none fetch sites, so a sibling subdomain cannot drive a write through the SameSite=lax session cookie
• move the login path test and the login URL builder into the shared auth module and use them from the middleware and the sign-in link
• ask the auth status once the event stream fails for good and redirect to the login page when the session is no longer authenticated, which is the only sign-out signal on settings routes
• extend check:auth to hold two concurrent auth-status requests and assert each request keeps its own cookie across awaits
• assert JSON requests send a content type, uploads keep their FormData body, and browser requests send no cookie
• assert an expired session never reaches the loader, returns to its in-app path without the .data suffix, and that the login page stays reachable while signed out

Test

• uv run pytest tests/test_auth.py tests/test_auth_stack.py
• pnpm check:auth
• pnpm typecheck
• pnpm build