fix(frontend): centralize cookie credentials in fetchWrapper and route callers through it

[chriswritescode-dev]

Centralize credentials: 'include' in fetchWrapper (with caller-signal abort propagation) and route all frontend auth-cookie fetches through it, removing per-call credentials/inline-fetch duplication across auth-info, files, TTS/STT, account settings, auth context, file browser, and the opencode event stream transport. Documents the same-origin deployment constraint and the deprecated CORS_ORIGIN / split-origin open question.

Summary

• Extend fetchWrapper to propagate caller AbortSignal and expose credentials uniformly; add 499 CANCELED handling
• Add authInfo API module (getAuthConfig, listUserPasskeys) backed by fetchWrapper
• Route files, tts, stt, FileBrowser/FilePreview, AccountSettings, AuthContext, TTSContext, useSTT, auth-loaders, and opencode-event-stream browserTransport through fetchWrapper
• Documentation: note same-origin default for VITE_API_URL and SameSite=Lax cross-site cookie caveat in authentication.md; mark CORS_ORIGIN as deprecated in environment.md
• Add tests for authInfo, fetchWrapper, files, tts, useSTT, and browserTransport

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation

Checklist

• Code follows project style (no comments, named imports)
• TypeScript types are properly defined
• Tests added/updated (80% coverage target)
• pnpm lint passes locally
• pnpm typecheck passes locally