Reads the shared Ory session cookie independently — no shared code with App B.