Respect the scoped Inventory guest hint on arrival (#255)

ddiff --git a/server/http/pages.js b/server/http/pages.js
iindex 5889e0d..4a84486 100644
---- a/server/http/pages.js
++++ b/server/http/pages.js
@@@ -96,7 +96,7 @@ function createPageRoutes(ctx) {
      const url = urls(config).path;
      const card = (d, options = {}) => renderCard(d, { ...options, url });
      const PUBLIC_CACHE = cache.htmlHeaders({ maxAge: 300 });
--    const page = (req, res, o, status = 200) => send(res, status, { viewer: req.viewer, config, path: req.originalUrl, ...o });
++    const page = (req, res, o, status = 200) => send(res, status, { viewer: req.viewer, config, path: req.originalUrl, ssoHint: req.cookies?.ov_sso_hint, ...o });
      const signedIn = (req) => (req.viewer && req.viewer.kind === 'user' && SUBJECT_RE.test(String(req.viewer.subject || '')) ? req.viewer.subject : null);
      const notFound = (req, res, what) => page(req, res, { title: 'Not found', body: html`<h1>Not found</h1><p>${what} <a href="${url(`/items`)}">Browse every item</a>.</p>` }, 404);
  
ddiff --git a/server/render/layout.js b/server/render/layout.js
iindex 66fb4b7..1b32632 100644
---- a/server/render/layout.js
++++ b/server/render/layout.js
@@@ -68,7 +68,8 @@ function renderPage(o) {
              ? [{ label: 'My', href: new URL('/', absolute('/')).href, icon: 'fa-house' }, { label: 'Yours', href: url('/me'), icon: 'fa-shirt' }, { label: 'Items', href: url('/items'), icon: 'fa-tag' }, { label: 'Workshop', href: url('/workshop'), icon: 'fa-screwdriver-wrench' }]
              : [{ label: 'Home', href: url('/'), icon: 'fa-house' }, { label: 'Items', href: url('/items'), icon: 'fa-tag' }, { label: 'Yours', href: url('/me'), icon: 'fa-shirt' }, { label: 'Workshop', href: url('/workshop'), icon: 'fa-screwdriver-wrench' }],   // phones: the bottom tab bar (Shared 4.20)
          history: { type: 'page', title: o.title || SITE_NAME },
--        silentLogin: absolute('/auth/login') + '?silent=1&next={url}',
++        // Scoped cookies are renamed at the Express boundary; Shared cannot see inventory_ov_sso_hint itself.
++        silentLogin: o.ssoHint === 'guest' ? null : absolute('/auth/login') + '?silent=1&next={url}',
          sessionUrl: url('/auth/me'),
          tokenUrl: url('/auth/navbar-token'),
          fedcmLogin: url('/auth/fedcm'),
ddiff --git a/test/base-path.test.js b/test/base-path.test.js
iindex c3ccf6b..428c225 100644
---- a/test/base-path.test.js
++++ b/test/base-path.test.js
@@@ -85,6 +85,7 @@ const cookieHeader = (r) => r.headers.getSetCookie().map((c) => c.split(';')[0])
                  const r = await t.get('/inventory', { cookie, headers: { accept: 'text/html', 'user-agent': agent } });
                  assert.strictEqual(r.status, 200);
                  assert.match(r.text, /Sign in to see yours/);
++                if (cookie === 'inventory_ov_sso_hint=guest') assert.match(r.text, /"silentLogin":null/, 'a scoped sign-out disables the browser arrival flow');
              }
          }
      });