Session hydration, viewport export, Sentry sampling and auth field errors

[akargi]

Summary

Implements the session/config/monitoring work assigned to Akargi:

• Pages read the auth cookie during render, causing hydration mismatches and non-reactive auth state #1983 — Session hydration: the session store no longer reads the cookie at creation or during render. A hydrated flag plus useSessionHydration / useSessionToken hooks replace the old non-reactive useAdminToken cookie read. All render-time cookie reads on /usage, /credits, /payments, /payments/new, /payments/return and the admin pages are replaced by store-driven, hydration-gated rendering, so the first client render matches the SSR output. Cross-tab sign-out syncs via a localStorage signal + storage event listener.
• Next.js metadata exports viewport and themeColor through metadata, which Next 15 deprecates #1986 — Viewport export: export const viewport separated from metadata in app/layout.tsx (Next.js 14 requirement), same theme colour as app/manifest.ts.
• Sentry traces sample rate defaults to 100% and beforeSend assumes an Error object #1987 — Sentry sampling unified in lib/sentry-sampling.ts shared by client/server/edge configs. Default trace sampling 1.0 (dev) / 0.1 (prod). Session replays opt-in only (default 0). beforeSend no longer crashes on non-Error rejections — strings, undefined and plain objects are reported as NonError events. SENTRY_SETUP.md updated.
• Registration and login forms don't show server-side validation errors per field #1988 — Auth per-field errors: AuthApiError carries status + fieldErrors; the auth form renders 400 validation messages next to their input (aria-invalid, aria-describedby), maps 409 taken-email onto the email field, shows a single form-level message for 429, and focuses the first invalid field. Errors clear on edit.

Test updates

• require-admin.test.tsx — rewritten for the hydrated gate + cross-tab sign-out
• auth-form.test.tsx — 5 new cases for 400 field arrays, 409, 429, 401, error clearing
• session-store.test.ts (new) — hydration state machine, signal emission, private-browsing safety
• sentry-client-config.test.ts — defaultTracesSampleRate + describeException coverage
• payment-return-page.test.tsx — added use-session-hydration mock

Notes for reviewers

• The session-store changes are additive: setAccessToken and the cookie behaviour are unchanged, so sign-in and sign-out keep working exactly as before. The only new behaviour is that the token starts as null and is populated by the hydration effect.
• The Sentry server/edge configs now import from lib/sentry-sampling.ts instead of hardcoding tracesSampleRate: 1.0. This changes the default production behaviour from 100% to 10% sampling.
• The auth-form changes are purely additive: existing behaviour (success redirect, password confirmation mismatch) is unchanged.
• Merge coordination: ykargeee-bit's auth PR (Cookie-based session model, admin role gate and 401 handling #2049) replaces the session store wholesale; if both merge, resolve in favour of Cookie-based session model, admin role gate and 401 handling #2049's cookie session semantics and re-apply this PR's hydration gating on top.

Closes #1988
Closes #1987
Closes #1986
Closes #1983

[vercel]

@akargi is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@akargi Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits