Parly Talent: shared sign-in

The Talent shell at talent.parly.dev is gated by TALENT_ENABLED=1. With the gate off, that host returns 404. Its root visits a fixed session bridge on parly.dev, then returns to /talent/profile; signed-out visitors see the GitHub onboarding page without a redirect loop. Other Parly app routes go back to parly.dev. This shell currently includes the candidate profile only.

On the two canonical Cloud web hosts (parly.dev and talent.parly.dev), sign-in writes a Secure, HttpOnly, SameSite=Lax cookie named __Secure-parly_session with Domain=.parly.dev. Legacy host-only hub_token cookies are migrated through parly.dev and removed there. The shared cookie takes precedence so duplicate legacy cookies cannot select another account. No session token goes in a bridge URL. Localhost, Vercel previews and self-hosted deployments keep the existing host-only hub_token cookie and do not receive parent-domain scope.

Talent sign-out uses an origin-checked form POST to parly.dev to revoke and expire both shared and legacy main-domain sessions. Cookies are cleared even when the Hub cannot be reached. The Hub authenticates only Authorization: Bearer requests; receiving this browser cookie does not authorize a Hub API call.

Deployment boundary: every *.parly.dev hostname must remain first-party trusted infrastructure. Never point any such hostname at third-party services, preview builds, user-generated sites or tunnels: a parent-domain cookie is sent to every matching subdomain, not only the two web hosts. Use unrelated preview domains. The hostname/DNS assignment and enabling Talent are separate rollout steps; this code does not perform them.