Central auth smoke test for Thuluth apps.

This app only proves the Hanko deployment: login, passkeys, session validation, profile access, and logout.