Refactor top-level auth checks to use state instead of stores

[eyeseast]

Svelte 5 has a new reactivity system, and we probably don't need nearly as many stores as we have. In particular, our root app layout needs refactoring in a way that will likely touch lots of places that use the $me store.

More here:

• https://svelte.dev/docs/kit/state-management
• https://svelte.dev/docs/svelte/$state#Passing-state-into-functions

We do have a getCurrentUser function, which may make this easier.

[eyeseast]

It's possible getCurrentUser should just return page.data.me (or undefined) and not deal with state at all. We never modify the user state, despite it being a writable store. The source of truth is always the API.

(This is maybe how we always should have done it.)