feat(standalone): send session credentials on backend API calls

Backends with real auth (session cookies) need credentials:'include' on the
editor's cross-origin fetches — ts-rest clients, project file bytes/upload,
drift keepalive, lib item GET/PUT, sync-stack resolve. Cookie-less setups are
unaffected (the thin identity headers still ride along and same-site Lax
cookies simply don't exist). CDN/static-gallery fetches stay credential-less
(wildcard CORS rejects credentialed requests). The example backend's CORS now
sends allow-credentials — origin reflection was already exact, so this only
lets browsers accept those responses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016TxciQ5VkNYUZesgMSEMUr

web/backend/src/server.ts

@@ -150,7 +150,11 @@ async function project(scope: string): Promise<Project> {
 async function main(): Promise<void> {
   const app = Fastify({ logger: true, bodyLimit: 1024 * 1024 * 1024 });
   await app.register(cors, {
+    // `true` REFLECTS the request origin (never the literal `*`), so it stays
+    // valid for the editor's credentialed fetches; allow-credentials is what
+    // lets the browser accept those responses (cookie-less callers unaffected).
     origin: CORS_ORIGIN === "*" ? true : CORS_ORIGIN.split(","),
+    credentials: true,
   });
   app.get("/health", async () => ({ ok: true }));