migrate auth v2 code

frontend/src/hooks.server.ts

@@ -1,16 +1,45 @@
 import type { Handle } from '@sveltejs/kit';
-
-const COOKIE_NAME = 'session';
+import { createPbClient } from '$lib/server/pocketbase';
+import { SESSION_COOKIE, setSessionCookie, clearSessionCookie } from '$lib/server/session';
+import type { SessionUser } from '$lib/server/types';
+import { handleOf } from '@shared/slugify';
 
 export const handle: Handle = async ({ event, resolve }) => {
-  const raw = event.cookies.get(COOKIE_NAME);
-	if (raw) {
+	event.locals.user = null;
+	event.locals.pbToken = null;
+
+	const token = event.cookies.get(SESSION_COOKIE);
+
+	if (token) {
+		const pb = createPbClient(token);
 		try {
-			event.locals.session = JSON.parse(raw);
+			// authRefresh() does two jobs in one call:
+			//   1. Verifies the token (PB JWTs can't be checked offline — the
+			//      signing secret is per-record and never leaves PB), so this
+			//      round trip IS the verification step.
+			//   2. Returns the current record — the only way to get
+			//      name/role/famId, since PB doesn't embed custom fields in the
+			//      token itself.
+			const { record, token: freshToken } = await pb.collection('users').authRefresh();
+
+			event.locals.user = {
+				id: record.id,
+				name: record.name || record.username || '',
+				username: handleOf(record.username || ''),
+				role: record.role || 'parent',
+				famId: record.famId,
+				color: record.color || ''
+			} satisfies SessionUser;
+			event.locals.pbToken = freshToken;
+
+			if (freshToken !== token) {
+				setSessionCookie(event.cookies, freshToken);
+			}
 		} catch {
-			event.cookies.delete(COOKIE_NAME, { path: '/' });
+			// Expired, malformed, or revoked — drop it and treat as logged out.
+			clearSessionCookie(event.cookies);
 		}
 	}
 
 	return resolve(event);
-};
+};