docs: update architecture notes and TODO with Svelte 5 store migration plan

- AE__Architecture.md: minor wording fix
- TODO__Agents.md: add Svelte 4→5 store migration task (root cause of IDAA
  Novi re-auth bug; prerequisite for Phase 2c store refactor)
- PROJECT__Stores_Svelte5_Migration.md: new migration planning doc

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/TODO__Agents.md

@@ -5,6 +5,44 @@
 
 ## 🚧 Upcoming High Priority
 
+### [Stores] Svelte 4 → Svelte 5 State Migration (prerequisite for Phase 2c)
+The app uses `svelte-persisted-store` (Svelte 4 store contract) for all core persisted state
+(`ae_loc`, `idaa_loc`, `ae_api`, `ae_sess`, etc.). In Svelte 5 `$effect`, reading **any field**
+of a Svelte 4 store subscribes to the **entire store** — coarse-grained reactivity. This is the
+root cause of the IDAA Novi re-auth bug (2026-03-30): unrelated `$ae_loc` writes (e.g. iframe
+height, SWR cfg reload) triggered the Novi verification effect repeatedly.
+
+Migration target: replace `svelte-persisted-store` with Svelte 5 `$state`-based persistence
+(e.g. `runed` `PersistedState`, or a lightweight custom wrapper). This gives fine-grained
+reactivity — only effects that actually read a changed field re-run.
+
+**Phased approach (do NOT do all at once):**
+
+- [ ] **Phase A — Project plan + wrapper decision:** Write `PROJECT__Stores_Svelte5_Migration.md`.
+  Decide: `runed` library vs. custom `$state` + localStorage wrapper. Audit all store consumers.
+  Identify stores in priority order. Estimate blast radius per store.
+
+- [ ] **Phase B — Core auth stores (highest impact, start here):**
+  - `ae_loc` (persisted) — auth flags, site cfg, UI state; ~471 consumer sites across 150+ files
+  - `idaa_loc` (persisted) — Novi auth, IDAA query prefs
+  These two cause the most reactive noise. Migrating them also unlocks Phase 2c (separate `ae_auth`
+  store) since the callsite sweep is now required anyway.
+
+- [ ] **Phase C — Remaining persisted stores:**
+  - `ae_api` (persisted) — API config / JWT
+  - `ae_events_stores` persisted entries (badges, launcher, leads, pres_mgmt loc stores)
+
+- [ ] **Phase D — Non-persisted writable stores:**
+  - `ae_sess`, `idaa_sess`, `slct`, `slct_trigger`, `ae_auth_error`, `ae_trig`, `ae_snip`, etc.
+  - Lower urgency (no localStorage churn), but fine-grained reactivity still beneficial.
+
+- [ ] **Phase E — Phase 2c (unblocked after B):** Split `ae_loc` into `ae_auth` + `ae_app`
+  (see entry below — ~471 callsites, but sweep is cheap once already touching every consumer).
+
+**Project plan doc needed:** Yes — scope is app-wide. Do NOT start Phase B without Phase A.
+
+---
+
 ### [Stores] Refactor — Phase 2c (deferred)
 Phases 1, 2a, 2b are complete (see ✅ Completed below). One phase remaining: