feat: Crumbs by Bretzel — self-hostable notes app MVP

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/hooks.server.ts

@@ -0,0 +1,37 @@
+import type { Handle } from '@sveltejs/kit';
+import { redirect } from '@sveltejs/kit';
+import { validateSession, isSetupComplete } from '$lib/server/auth.js';
+
+const PUBLIC_PATHS = ['/login', '/setup', '/api/auth/login', '/api/auth/setup'];
+
+export const handle: Handle = async ({ event, resolve }) => {
+	const { pathname } = event.url;
+
+	// Allow public paths
+	if (PUBLIC_PATHS.some((p) => pathname.startsWith(p))) {
+		return resolve(event);
+	}
+
+	// Check if setup is complete
+	const setupDone = await isSetupComplete();
+	if (!setupDone) {
+		if (pathname !== '/setup') {
+			throw redirect(302, '/setup');
+		}
+		return resolve(event);
+	}
+
+	// Validate session
+	const sessionToken = event.cookies.get('session');
+	if (!sessionToken || !(await validateSession(sessionToken))) {
+		if (pathname.startsWith('/api/')) {
+			return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+				status: 401,
+				headers: { 'Content-Type': 'application/json' }
+			});
+		}
+		throw redirect(302, '/login');
+	}
+
+	return resolve(event);
+};