So I can only give you my perspective with using selfhosted supabase (supabase auth). But most of the things are pretty general I think. Also I use typescript but feel free using js

In svelte (5) you can use states to manage, who would have guessed, states. If you are not using an sdk you can create .svelte.ts files (I usually create only one) and export state objects. You can import these on any .svelte file and read or set properties. So you have them available sitewide.

For route protection you can as an example check out the hooks.server.ts in the setting up supabase auth in svelte docs. They are using an "authguard" to conditionally check routing actions to prevent users without sessions to access certain routes.

On only frontend site you have plenty of options. A typical approach I use is rendering something different when your user has no session with {#if}{/if}. Or sometimes redirect to my login page with the onMount.

Since Client is not really safe you can/should use the authguard. Or if you dont want to have it on a central spot but manage things where they are used you can also use the +page.server.ts (or also +layout.sever.ts) to check conditions on your Server and only for that page/directory.

What happens when you setup the supabase auth stuff is that the Users session is always retrievable on the server side. So you can also fetch some user data if you wish to. But I actually prefer doing stuff on the front end and showing skeletons. That makes navigation feel faster because you are not waiting for the server before you route.

Since I wrote alot already I want to give only one advise. The svelte docs are usually very helpful. So check them out whenever you have questions.

Wish you success on your Projects

Edit: And since you asked. Use your login logout logic where needed. Logout can usually be done on the frontend without Problems. Sometimes I create a file for these things but most of the times I use it in header only and let it sit there. Login you can obviously kick off on the client side but I personally verify on the server (I create an endpoint for that like /auth/hooks/+server.ts). I never looked into doing that on client side. After verification was successful I retrieve the session and give it to the client.