fix: global Unauthorized handling — redirect to /login, suppress log spam

- Add UnauthorizedError class exported from services.ts
- loggedApiCall now detects Unauthorized GraphQL errors, logs at DEBUG
  instead of ERROR, and throws UnauthorizedError (no more stack dumps)
- hooks.server.ts catches UnauthorizedError from any load function and
  redirects to /login?redirect=<original-path>
- getRecordings, getRecording, getAnalytics now accept an optional token
  and use getAuthClient server-side so cross-origin cookie forwarding works
- Update play/recordings, play/buttplug, me/analytics page.server.ts to
  pass the session token — prevents Unauthorized on auth-protected pages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/frontend/src/routes/play/buttplug/+page.server.ts

@@ -1,19 +1,14 @@
 import { getRecording } from "$lib/services";
 import type { Recording } from "$lib/types";
 
-export async function load({ url, fetch }) {
+export async function load({ url, fetch, cookies }) {
   const recordingId = url.searchParams.get("recording");
+  const token = cookies.get("session_token") || "";
 
   let recording: Recording | null = null;
   if (recordingId) {
-    try {
-      recording = await getRecording(recordingId, fetch);
-    } catch (error) {
-      console.error("Failed to load recording:", error);
-    }
+    recording = await getRecording(recordingId, fetch, token).catch(() => null);
   }
 
-  return {
-    recording,
-  };
+  return { recording };
 }