feat: start.sh for production server, hooks.server.ts stub, svelte.config cleanup

- start.sh: builds and launches Node production server on 192.168.0.94:4078
- Multi-domain CSRF: not needed — SvelteKit natively passes when Origin matches Host
- hooks.server.ts: minimal stub with explanation
- svelte.config.js: reverted csrf experiment (not supported in this version)

src/hooks.server.ts

@@ -0,0 +1,4 @@
+// hooks.server.ts intentionally minimal — CSRF is handled natively by SvelteKit
+// when the Origin header matches the request Host. For multi-domain setups,
+// trusted origins are declared in svelte.config.js via kit.csrf.checkOrigin / allowedOrigins.
+export {};

start.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# start.sh — build and launch humor-units production server
+set -e
+
+cd "$(dirname "$0")"
+
+echo "Building..."
+npx vite build
+
+echo "Starting server on 192.168.0.94:4078..."
+exec env \
+  PORT=4078 \
+  HOST=192.168.0.94 \
+  ORIGIN=http://192.168.0.94:4078 \
+  node build/index.js

svelte.config.js

@@ -3,7 +3,7 @@ import adapter from '@sveltejs/adapter-node';
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
 	kit: {
-		adapter: adapter()
+		adapter: adapter(),
 	},
 	vitePlugin: {
 		dynamicCompileOptions: ({ filename }) =>