`/__/oauth/whoami` CORS breaks every cross-origin dev frontend

[benh]

Describe the bug

The 1.4.0 @reboot-dev/reboot-react client probes /__/oauth/whoami
with credentials: "include" before settling auth state. The 1.4.0 dev
server's response (a 404 on an app with no oauth=) carries
access-control-allow-origin but NOT
access-control-allow-credentials: true, which a credentialed fetch
requires — so the browser discards the response, the client can never
see the 404 that would settle it "unauthenticated", and it retries on
exponential backoff forever. Every Vite-on-:5173 / backend-on-:9991 dev
setup hits this: seconds of delay on every page's data plus a console
full of CORS errors. Fix shipped here: serve same-origin — Vite proxies
/__/ (with ws: true for the reactive WebSockets) and
/theater.v1. to :9991, and the client URL defaults to
window.location.origin (see web/vite.config.ts / web/src/main.tsx).
Reported upstream (docs/reboot-bug-report/).