feat: start.sh for production server, hooks.server.ts stub, svelte.config cleanup

- start.sh: builds and launches Node production server on 192.168.0.94:4078
- Multi-domain CSRF: not needed — SvelteKit natively passes when Origin matches Host
- hooks.server.ts: minimal stub with explanation
- svelte.config.js: reverted csrf experiment (not supported in this version)

svelte.config.js

@@ -3,7 +3,7 @@ import adapter from '@sveltejs/adapter-node';
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
 	kit: {
-		adapter: adapter()
+		adapter: adapter(),
 	},
 	vitePlugin: {
 		dynamicCompileOptions: ({ filename }) =>