1. Provider setup
2. Server auth in loader/function
Header propagation contract
authenticateRequest() may rotate/exchange session state and returns response headers (Set-Cookie, auth transport headers).
getAuth vs requireAuth
getAuth: read auth staterequireAuth: enforce authentication viaprotect()
