fix(js): preserve same-origin credentials

Send interaction and page-swap fetches with same-origin credentials so cookies/session/CSRF context stay available to integration-layer policy without broad CORS behavior.

req: auth/005

slhx-js/runtime/slhx.js

@@ -131,6 +131,7 @@
         method,
         body,
         headers,
+        credentials: "same-origin",
         signal: abort.signal,
       });
       if (pending.get(target)?.abort !== abort && policy === "latest") return;
@@ -158,7 +159,10 @@
   }
 
   async function navigateUrl(href, root, mode = "replace") {
-    const response = await fetch(href, { headers: { "X-SLHX-Partial": "1", "Accept": "text/html" } });
+    const response = await fetch(href, {
+      headers: { "X-SLHX-Partial": "1", "Accept": "text/html" },
+      credentials: "same-origin",
+    });
     if (!await applyResponse(response, root) && mode !== "none") {
       location.href = href;
       return;

slhx-js/tests/runtime.rs

@@ -9,6 +9,14 @@ fn runtime_posts_urlencoded_forms_by_default() {
     assert!(source.contains("application/x-www-form-urlencoded;charset=UTF-8"));
 }
 
+#[test]
+fn runtime_fetches_with_same_origin_credentials() {
+    // req: auth/005
+    let source = slhx_js::RUNTIME_JS;
+
+    assert_eq!(source.matches("credentials: \"same-origin\"").count(), 2);
+}
+
 #[test]
 fn runtime_handles_get_forms_without_request_body() {
     let source = slhx_js::RUNTIME_JS;