- Guard __dev/login with oauth check to prevent crash when OAuth not configured
- Fix sendResponse to preserve duplicate Set-Cookie headers (flat array format)
- Remove misleading status_code: 0 from telemetry emit
- Stabilize HMAC key derivation with sorted JSON keys
- Log PDS proxy local index failures via emit() instead of silent catch
- Extract shared withDpopRetry() to deduplicate proxy retry logic
- Share isHatkRoute() between adapter.ts and vite-plugin.ts
- Fix hasRenderer to use live function call instead of boot-time const
- Support configurable cookie name in generated client code
- Remove any types from pds-proxy.ts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Rewrite server.ts to Request→Response handler, add SSR renderer and
Node.js adapter, implement session cookies for viewer resolution in
SSR, add /__dev/login endpoint for test auth, register core XRPC
handlers for preferences, fix OAuth scope joining, switch test context
to SQLite, and add /__dev/ route forwarding in vite plugin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>