Description

• Upgrades SvelteKit 2.70 to 3.0 using sv migrate sveltekit-3: config moves into vite.config.ts, $lib becomes #lib (subpath import in a minimal package.json), $app/environment becomes $app/env.
• Adds $stores/page, a store over $app/state, since $app/stores is removed and $app/state doesn't update in components without runes.
• Allows the external redirect to the OIDC provider, which Kit 3 now requires.
• Keeps "cancel pending restore" and "withdraw announcement" on the current page; Kit 3 otherwise navigates to the action's page.
• Clears deprecations: invalidateAll to refreshAll, json() to Response.json(), goto replaceState to replace.

The remaining build warnings (custom aliases, Deno adapter API) are left for the Node migration in #963.

Related issue

Part of #963

User-facing docs

Dictionarry-Hub/profilarr.com#31 documents the Content-Type requirement on the Authentication page.

Technical docs

docs/CONTRIBUTING.md, docs/backend/api.md, docs/backend/drift.md, docs/backend/security.md, docs/api/v1/openapi.yaml.

Testing

Existing CI suites cover the change: build, lint, type checks, unit, integration and E2E auth. Integration tests were updated for Kit 3 behaviour: form action failures now return their real status, and the test client sends Content-Type on DELETE.

No new tests, by decision:

• The 403 for a missing Content-Type is SvelteKit's own CSRF check, not our code. It was verified with curl against a preview build.
• Client-side $page updates and the two cross-page forms would need browser tests beyond the current E2E auth suite. $page updates were checked by hand in a preview build; the two forms were checked against SvelteKit's enhance source.

Upgrade impact

API requests that change data (POST, PUT, PATCH, DELETE) must send a Content-Type header, e.g. Content-Type: application/json. Requests without one are rejected with 403.

This is an accepted trade-off. SvelteKit 3's CSRF check runs before our hooks, so exempting API key requests would need a custom server or adapter. The Node migration (#963) moves to the official adapter-node specifically to stop maintaining one.

Confirmation

• I have read and followed the contribution guidelines.
• I have reviewed this contribution, including any AI-written code or text, understand the changes, and can address review feedback.
• The description and any claimed verification accurately reflect what changed and what I actually checked.