fix(idaa): move Recovery Meetings load out of +layout.ts, gate $effect on auth

+layout.ts was firing on SvelteKit link prefetch, writing events to IDB
before Novi auth ran. Stripped to thin shell; the existing search $effect
in +page.svelte already handles SWR load+revalidation — just needed an
auth gate (novi_verified || trusted_access) at the top.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/idaa/(idaa)/recovery_meetings/+page.svelte

@@ -49,6 +49,11 @@ $effect(() => {
     const account_id = $ae_loc.account_id;
     if (!account_id) return; // Wait for account context
 
+    // Auth gate: do not fetch IDAA events for unauthenticated users.
+    // WHY $effect and not +layout.ts: layout load functions fire on SvelteKit link prefetch,
+    // causing private data to be written to IDB before Novi auth runs.
+    if (!$idaa_loc.novi_verified && !$ae_loc.trusted_access) return;
+
     // Track filters and the search version (trigger)
     const qry_params = {
         v: $idaa_loc.recovery_meetings.search_version,