enable dev|prod envs with simpler env vars system

frontend/src/routes/[fam]/+layout.server.ts

@@ -1,4 +1,5 @@
-import { PROXY_URL } from '$lib/server/env';
+import { PROXY_URL } from '$app/env/public';
+import { pbAdmin } from '$lib/server/pb-admin';
 
 const HONO_URL = PROXY_URL;
 
@@ -77,5 +78,16 @@ export async function load(event) {
 		}
 	}
 
-	return { session, isParent, role: session?.role || 'child', famId, chat, deviceToken };
+	return {
+		session,
+		isParent,
+		role: session?.role || 'child',
+		famId,
+		chat,
+		deviceToken,
+		// fams is superadmin-only (non-realtime). Fetched server-side for both roles.
+		fam: famId
+			? await pbAdmin.getOne('fams', famId).catch(() => null)
+			: null
+	};
 }

frontend/src/routes/[fam]/+layout.svelte

@@ -46,7 +46,7 @@
 
 	onMount(() => {
 		initPbFromCookie();
-		if (page.data.famId) famStore.init(page.data.famId);
+		if (page.data.famId) famStore.init(page.data.famId, page.data.fam);
 		const chat = page.data.chat;
 		if (chat?.famId && chat?.actor) {
 			chatStore.init({

frontend/src/routes/[fam]/[username]/+page.server.ts

@@ -1,7 +1,6 @@
 import { fail, redirect } from '@sveltejs/kit';
 import { hono } from '$lib/server/hono';
-import { memberApi } from '$lib/client/api';
-import { PROXY_URL } from '$lib/server/env';
+import { PROXY_URL } from '$app/env/public';
 
 const HONO_URL = PROXY_URL;
 
@@ -101,7 +100,11 @@ export async function load(event) {
 
 		let chores: any = {};
 		try {
-			chores = await memberApi.myChores(deviceToken, data.famId);
+			const choresRes = await fetch(`${HONO_URL}/api/members/my-chores`, {
+				method: 'POST',
+				headers: { 'x-device-token': deviceToken, 'x-device-famid': data.famId }
+			});
+			chores = await choresRes.json();
 		} catch {}
 
 		return {

frontend/src/routes/[fam]/[username]/preferences/+page.server.ts

@@ -1,6 +1,6 @@
 import { redirect } from '@sveltejs/kit';
 import { hono } from '$lib/server/hono';
-import { PROXY_URL } from '$lib/server/env';
+import { PROXY_URL } from '$app/env/public';
 
 const HONO_URL = PROXY_URL;
 

frontend/src/routes/[fam]/[username]/settings/+page.svelte

@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { enhance } from '$app/forms';
-	import { onMount, onDestroy } from 'svelte';
-	import { pb, initPbFromCookie } from '$lib/pocketbase';
 	import { famStore } from '$lib/stores/fam.svelte';
 	import { ViewHeader, CardGrid, Card, Button } from '$lib/components';
 	import { COMMON_TIMEZONES } from '../../../../../../timezone.ts';
@@ -11,8 +9,8 @@
 	let { data } = $props();
 
 	// fam is sensitive (inviteCode, stripeCustomerId, featureFlags) — never in the
-	// public famStore stream. This admin-only page subscribes to `fams` with the
-	// authenticated PB instance (pb_token cookie), page-local only.
+	// public famStore stream. It is superadmin-only, fetched server-side by the
+	// layout load. Writes go through form actions; no live fam subscription.
 	let fam = $state(data.fam);
 	let famSlug = $state(page.params.fam);
 
@@ -65,32 +63,6 @@
 	let members = $state(famStore.initialized ? famStore.members : data.members || []);
 	let deletingSeason = $state<any>(null);
 
-	function syncFamFromRecord(record: any) {
-		fam = record;
-		payday = Number(record.payday ?? 1);
-		paydayTime = record.paydayTime || '18:00';
-		timezone = record.timezone || 'auto';
-	}
-
-	onMount(async () => {
-		initPbFromCookie();
-		if (!fam?.id) return;
-		try {
-			await pb.collection('fams').subscribe(fam.id, ({ action, record }) => {
-				if (action === 'update') syncFamFromRecord(record);
-			});
-		} catch (e) {
-			console.error('fams subscribe failed:', e);
-		}
-	});
-
-	onDestroy(() => {
-		if (fam?.id)
-			pb.collection('fams')
-				.unsubscribe(fam.id)
-				.catch(() => {});
-	});
-
 	function copy(url: string) {
 		navigator.clipboard.writeText(url);
 		copied = true;