M3 slice 1 (coreci-chat#16): wrap the root layout's children with a theme
provider (light/dark/system, persisted, no external dep) and a session
wrapper over @coreci/auth's session lane (identity via GET /api/me, client
config from NEXT_PUBLIC_API_BASE_URL, default same-origin). Additive only:
no redirects or gates, SSR pages keep server-side session resolution, and
no boot-time DDL (deploy owns DDL, app boots schema-check only). Pure
logic extracted to app/shell/_lib.ts + unit tests, repo Wave-J convention.