Remove Lucia from the `lucia` adder

[AdrianGonz97]

The library is being deprecated in favor of users implementing the session handling themselves (see: lucia-auth/lucia#1707).

I've migrated over an example project that uses the /demo route that our adder creates: https://github.com/AdrianGonz97/definitely-not-lucia-sveltekit-example

and honestly, it's not all that much different besides the additional ~60 LoC in lib/server/auth.ts (which can be further simplified). With this change, we may also be able to pull off the // TODO: comment idea that @benmccann proposed for users that don't necessarily want to use drizzle

There's also been mentions of a potential scaffolding CLI where it adds the necessary session handling code to your project. We may be able to utilize this as well (if it's ever made).

[benmccann]

I wonder if we need to create a session in the database. I'm not sure if it's something most apps would use. If you did want to store something in the database for a logged-in user such as a shopping cart, you would probably put it in a table dedicated for that use rather than a general session table. For a logged out user you would probably use local storage. I feel like a general session table isn't necessarily a great practice and I'm not sure we should generate those extra lines by default.

[Conduitry]

It's impossible to SSR something based on local storage or to have a website work without JS if you use it, both of which are pretty core tenets of Svelte's ideology.

[benmccann]

You could use a cookie then. In either case you're not going to be able to use the referred to code sample for a logged out user because it requires a user to work. I'm not sure the generic session in a DB approach is one we should be promoting?

[benmccann]

I guess the new one could just be called Oslo.

It'd also be nice to have an Arctic integration at some point. But might be too much to do before launch: https://lucia-auth.com/tutorials/github-oauth/sveltekit

[benmccann]

Oh, I was a bit sleep deprived when I looked at this the other day. I thought it was storing arbitrary info in the session table, but it's not. It's merely storing a session ID. That's probably not strictly necessary, but I guess it allows you to revoke a session

There's some stuff in Lucia that is just copy/pasted a bunch right now and I think could live in one of their other libraries: lucia-auth/lucia#1707 (comment)

This item feels a bit big at the moment. Maybe we should just remove Lucia for launch so that we have more time to consider and see how things shake out