Implement SaaSKit Python

Add login, callback, an encrypted sk_session cookie, logout, and refresh in FastAPI. Then stop.

Guardrails

• MUST keep SCALEKIT_REDIRECT_URI, the dashboard Redirect URI, and the process host:port the same string.
• MUST call auth.install(app). app.include_router(auth.router) alone skips the 302 handler.
• MUST set cookie_secure=False on local HTTP. MUST set it True in production.
• MUST treat returnTo as a relative path only (/..., not //…). The adapter already sanitizes it.

Gotchas

• setup-saaskit already wrote env and registered the redirect. Start there.
• Read SCALEKIT_ENVIRONMENT_URL, SCALEKIT_CLIENT_ID, SCALEKIT_CLIENT_SECRET, and SCALEKIT_REDIRECT_URI. Never SCALEKIT_ENV_URL. Do not prepend https://.
• Also need COOKIE_ENCRYPTION_SECRET (openssl rand -base64 32). Keep it identical on every server.
• Default path is FastAPI ScalekitAuth. Do not hand-roll ScalekitClient routes. Do not copy Express cookies from manage-saaskit-sessions.
• Adapter defaults: GET /login, /callback, /logout. Cookie is sk_session (HttpOnly, SameSite=lax). CSRF cookie is sk_oauth_state.
• If SCALEKIT_REDIRECT_URI already ends in /auth/callback, pass callback_path="/auth/callback" or change both the env and the dashboard to /callback. Keep that URI's host and port. Run the app on that port. Do not keep port 3000 in env and run FastAPI on 5001.
• user from requires_auth is access-token claims. sub is always present.
• requires_auth refreshes. Do not add /auth/refresh. Do not return a Response from a protected endpoint — that drops the refreshed cookie.
• Register the Initiate Login URL and the Post Logout Redirect URI too.