rc-sveltekitlisted

# SvelteKit 2 + Svelte 5 Full-stack UI with SSR/SEO and progressive enhancement. Target: **SvelteKit 2.x**, **Svelte 5** (runes), **adapter-node** build run under **Bun ≥ 1.3**. Pair with `rc-axum` when the API is a separate Rust service. ## Core workflow 1. **Routes** — file-based `src/routes`; prefer server `load` for private/SEO data. 2. **SSR** — `+page.server.ts` for data that must hit the API with secrets; never put secrets in `PUBLIC_*`. 3. **Forms** — form actions + `fail()` for validation; progressive enhancement. 4. **Hooks** — `hooks.server.ts` for session → `event.locals`; keep locals in sync after actions that change cookies. 5. **Security** — CSRF (built-in), cookie flags, CSP. Read `references/security.md`. 6. **Deploy** — adapter-node, `HOST=127.0.0.1`, reverse proxy. Read `references/ssr-deploy.md`. 7. **Test** — Vitest + Playwright as needed. Read `references/testing.md`. ## Reference guide | Topic | File | Load when | | ----- | ---- | --------- | | Load, actions, layout, env | `references/guide.md` | Building routes | | CSRF, cookies, CSP, XSS | `references/security.md` | Auth/sessions/public pages | | adapter-node, env, VPS | `references/ssr-deploy.md` | Deploy / SSR config | | Unit & e2e tests | `references/testing.md` | Tests | ## Must do - Use **Svelte 5** runes (`$state`, `$props`, `$derived`) in new components unless the repo is still Svelte 4. - Server-only secrets via `$env/dynamic/private` or `$env/static/private` — never `PUBLIC_`. - Same-o