Reads the shared Ory session cookie independently — no shared code with App A.