fix(cors): AllowCredentials:true on api so dashboard /auth/exchange works (P0 follow-up)

[mastermanas805]

Summary

P0 follow-up to instanode-web#150 + #151 — completes the AUTH-004 fix chain.

Live verification via chrome devtools MCP after both web PRs shipped:

Access to fetch at 'https://api.instanode.dev/auth/exchange' from origin
'https://instanode.dev' has been blocked by CORS policy: The value of
the 'Access-Control-Allow-Credentials' header in the response is ''
which must be 'true' when the request's credentials mode is 'include'.

Root cause

fiberCORS.Config in internal/router/router.go:255 never set AllowCredentials. The dashboard SPA's AUTH-004 cookie-exchange POST uses credentials: 'include' to send the HttpOnly instanode_session_exchange cookie cross-origin (instanode.dev → api.instanode.dev). The CORS spec requires the response to carry Access-Control-Allow-Credentials: true for the browser to ALLOW the SPA to read the response body. Without it, fetch rejects the read with "blocked by CORS policy".

Existing localStorage-Bearer auth wasn't affected because Bearer doesn't trigger the credentials-include code path. Only AUTH-004 OAuth/magic-link logins broke.

Fix

Add AllowCredentials: true to fiberCORS.Config. Safe because AllowOrigins is an explicit allowlist ("https://instanode.dev,https://www.instanode.dev") — the CORS spec forbids credentials + wildcard origin precisely to prevent rogue sites from siphoning cookies.

Tests (new)

internal/router/cors_credentials_test.go:

• TestCORS_AllowCredentialsHeader — actual cross-origin POST response carries Access-Control-Allow-Credentials: true
• TestCORSPreflight_HasAllowCredentialsHeader — OPTIONS preflight response carries the same header (browsers check both)

A future router.New edit that drops AllowCredentials regresses prod login and fails these tests.

Companion PRs

• instanodedev/instanode-web#150 (merged) — SPA reads ?signed_in=1 + POSTs /auth/exchange
• instanodedev/instanode-web#151 (merged) — dropped Accept header to avoid preflight allowlist 403

After this api PR merges + auto-deploys, the full GitHub OAuth + magic-link flow works end-to-end.

Test plan

• CI: existing CORS / preflight tests stay green
• CI: new TestCORS_AllowCredentialsHeader + preflight test pass
• After merge: live chrome MCP — click "Continue with GitHub" → land on /app (not "Sign-in failed")

🤖 Generated with Claude Code