## Instructions - Svelte 5 runes only: `$state()` for reactive vars, `$derived()` for computed, `$effect()` for side-effects, `$props()` for component inputs; no legacy `$:` labels in new code. - Routing: `src/routes/+page.svelte` + `+layout.svelte` + `+page.ts/+page.server.ts` loaders; `+server.ts` for API endpoints; `[...slug]` rest, `(group)` layout groups that vanish from URL. - Load functions: `+page.server.ts load()` for secrets/DB (cookies, fetch server-side), `+page.ts load()` for client-safe; return plain serializable data, `error(404)` / `redirect(302, '/login')` from `@sveltejs/kit`. - Forms: `

` progressive enhancement; `+page.server.ts export const actions = { update: async ({request, cookies}) => {...} }` returning `fail(400, {errors})`. - Auth/session: httpOnly cookie `session` set in login action, `hooks.server.ts handle()` populates `event.locals.user`, `+layout.server.ts` exposes `data.user` to all pages. - Styling: scoped `