feat: start.sh for production server, hooks.server.ts stub, svelte.config cleanup

- start.sh: builds and launches Node production server on 192.168.0.94:4078
- Multi-domain CSRF: not needed — SvelteKit natively passes when Origin matches Host
- hooks.server.ts: minimal stub with explanation
- svelte.config.js: reverted csrf experiment (not supported in this version)

start.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# start.sh — build and launch humor-units production server
+set -e
+
+cd "$(dirname "$0")"
+
+echo "Building..."
+npx vite build
+
+echo "Starting server on 192.168.0.94:4078..."
+exec env \
+  PORT=4078 \
+  HOST=192.168.0.94 \
+  ORIGIN=http://192.168.0.94:4078 \
+  node build/index.js