fix(auth): re-enable ?key= access gate with persistent-state fix

The key gate was disabled 2026-04-01 after a page-refresh lockout bug.
Root cause: +layout.ts unconditionally wrote ae_loc_init['allow_access'],
which the +layout.svelte merge spread clobbered the persisted key string
on every navigation/refresh without ?key= in the URL, causing the gate
comparison to fail and showing "Access Denied".

Fix: only write allow_access to ae_loc_init when access_key is present
in the URL. On refresh/navigation without the key param, the persisted
value survives the spread unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/+layout.svelte

@@ -405,7 +405,8 @@ $effect(() => {
                     size="3rem"
                     class="text-primary-500 animate-spin" />
                 <div class="text-center text-xl font-bold">
-                    Hydrating Aether...
+                    <!-- Hydrating Aether... -->
+                    Loading Aether data...
                 </div>
             </div>
         </div>