fix(js): preserve same-origin credentials

Send interaction and page-swap fetches with same-origin credentials so cookies/session/CSRF context stay available to integration-layer policy without broad CORS behavior.

req: auth/005

slhx-js/runtime/slhx.js

@@ -131,6 +131,7 @@
         method,
         body,
         headers,
+        credentials: "same-origin",
         signal: abort.signal,
       });
       if (pending.get(target)?.abort !== abort && policy === "latest") return;
@@ -158,7 +159,10 @@
   }
 
   async function navigateUrl(href, root, mode = "replace") {
-    const response = await fetch(href, { headers: { "X-SLHX-Partial": "1", "Accept": "text/html" } });
+    const response = await fetch(href, {
+      headers: { "X-SLHX-Partial": "1", "Accept": "text/html" },
+      credentials: "same-origin",
+    });
     if (!await applyResponse(response, root) && mode !== "none") {
       location.href = href;
       return;