Enhance ATProto OAuth with encrypted server-side sessions, eliminating client-side token exposure for improved security. Changes: - Add encrypted session storage with AES-256-GCM (src/lib/server/session.ts) - Add CSRF state validation for OAuth flow (src/lib/server/csrf.ts) - Add API routes: /api/auth/{login,callback,logout,switch} - Add API proxy that injects auth from session cookies - Add discriminated union types for auth state (App.Locals) - Add branded types: DID, Handle, InstanceURL, AccountId, SealedToken - Update client to route requests through auth-injecting proxy - Update hooks.server.ts to decrypt sessions into locals.auth - Add Vitest configuration and comprehensive test coverage - Remove client-side OAuth callback (now server-side) - Remove legacy Lemmy password management pages Security improvements: - Tokens never exposed to browser JavaScript - Session cookies encrypted with AES-256-GCM - CSRF protection via OAuth state parameter - Open redirect prevention in login flow - Path traversal protection in API proxy Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>