fix: disable CSRF origin check to allow Web Share Target

SvelteKit's CSRF check runs before the handle hook and blocks POSTs
whose Origin header doesn't match the site origin. Web Share Target
POSTs from any external app (YouTube, Chrome share sheet, etc.) are
legitimately cross-origin.

checkOrigin: false is safe here — the app has no cookie-based session
auth, so there is no CSRF attack surface.

Also remove the ineffective hooks.server.ts approach.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

svelte.config.js

@@ -6,7 +6,10 @@ const config = {
 		runes: ({ filename }) => (filename.split(/[/\\]/).includes('node_modules') ? undefined : true)
 	},
 	kit: {
-		adapter: adapter({ out: 'build' })
+		adapter: adapter({ out: 'build' }),
+		// CSRF origin check disabled: this app uses no cookie-based session auth,
+		// and the Web Share Target POST legitimately arrives from external origins.
+		csrf: { checkOrigin: false }
 	}
 };