fix(hosted-app): Preserve preview cookie across authorize redirect #143

Problem

Opening a generated hosted-app preview_url from LibreChat is a cross-site top-level navigation. The authorize handler sets __Host-codeapi-app with SameSite=Strict and immediately returns a 303 to /. The redirect remains part of the cross-site navigation chain, so browsers can withhold the new Strict cookie on the redirected request; the first preview load then returns 401 Preview authorization required even though the cookie was stored.

Source: service/src/hosted-app/preview-gateway.ts in merged PR #58 / commit 9df5cf8ae007b7732f894a82596cc8db8985861f.

Expected

A fresh preview_url should render the app on its first navigation without requiring a manual refresh, while preserving the host-only, secure, HttpOnly authorization boundary.

Suggested coverage

Add a browser-level cross-site navigation test for the authorize → 303 → / flow and use cookie/redirect semantics compatible with that flow (for example, SameSite=Lax for the read-entry cookie if the security model permits it).