fix(api): support SDK session refresh CORS

[markwylde]

Summary

• allow registered public SPA origins to call SDK user session and organization endpoints with credentialed CORS
• allow first-party cookie refresh to mint tokens for the calling public SPA client while preserving strict binding for explicit refresh tokens
• add regressions for SDK CORS and hosted cookie refresh recovery

Verification

• node --env-file-if-exists=../../.env --test --test-reporter=spec src/controllers/token.test.ts src/controllers/user/oauthEndpoints.test.ts src/http/createServer.test.ts
• npm run tidy
• npm run build

Closes #153