fix(web): allow direct entry from any local browser

[tt-a1i]

Opening the terminal-displayed local address in a fresh browser rendered the workbench but rejected workspace actions with invalid or missing token. The root document now dynamically supplies the current Host credential, so a local browser can use the bare address without pairing or copying a fragment link.

The client prefers the current document credential over stale fragment/storage values and continues working when browser storage is unavailable. API bearer checks remain mandatory. Credential issuance uses exact Host/Origin, rejects foreign Referer and cross-site/same-site/non-document Fetch Metadata, and does not inherit API allowedOrigins exceptions. HTML is uncached and protected with CSP framing restrictions, CORP, COOP, X-Frame-Options and nosniff. No cookie, CORS grant, static credential or new bootstrap API is introduced. Separate Vite development keeps its legacy fragment entry.

Decision 0003 records the maintainer-approved local-document trust boundary and limitations. Local programs and compromised same-origin code remain within the existing local-machine trust model. Refresh obtains a new credential after a Host restart; mutations are not automatically replayed.

Validation:

• Regression tests failed before the change: root lacked a credential and stale fragment won over current-page identity.
• bun run check passed.
• bun run test: 1457 Node passed, 1 skipped; 106 Vitest passed.
• Production E2E: 8 passed, using bare URLs and independent browser contexts, stale storage, unavailable storage and reload. Workspace-picker routing is mocked: this proves dispatch/authentication, not native OS picker acceptance.
• Host tests cover raw navigation headers, foreign API-allowed Origin, cross-site/same-site/iframe denials, no token in static JS, and anonymous API 401.
• Real standalone runtime smoke in isolated directories: bare document credential -> authenticated snapshot -> actual workspace import returned 201. The native OS chooser was not exercised.
• Two independent final reviews found no P2+ issues.

An earlier full run under concurrent load also failed an unrelated settled-launch repaint timing test; the clean full rerun above passed. No runtime/performance claim is based on that failed run.

Fixes #448.