fix(web): same-origin check on cookie-authenticated kit and collection writes #113

Follow-up to #101, which covered favorite/vote/rate/review. The personal kit (kit-http.ts) and collection (collection-http.ts) write paths accept session cookies without crossOriginRefusal (apps/web/app/lib/auth/same-origin.ts). They are currently shielded by the mandatory Content-Type: application/json (and preflight for PATCH/DELETE), so this is defence in depth, not an open hole. Apply the check only when the request is authenticated by the session cookie, so API-key clients keep working; add a test per route group: a foreign Origin returns 403, while same-origin and header-less requests pass. Found during review of #112.