fix(login): drop Accept header — /auth/exchange POST blocked by CORS preflight (P0 follow-up)

[mastermanas805]

Summary

P0 follow-up to #150. That PR added the AUTH-004 cookie-exchange flow but the fetch call included Accept: application/json, which forced a CORS preflight that the api's PreflightAllowlist rejects. Live login was still broken after #150 shipped.

Root cause

Live verification via chrome devtools MCP:

POST https://api.instanode.dev/auth/exchange   net::ERR_FAILED

Confirmed with direct curl:

$ curl -i -X OPTIONS https://api.instanode.dev/auth/exchange \
    -H 'Origin: https://instanode.dev' \
    -H 'Access-Control-Request-Method: POST' \
    -H 'Access-Control-Request-Headers: accept'
HTTP/2 403 Forbidden

api's allowlist (api/internal/router/router.go:242):

corsAllowHeaders = "Content-Type,Authorization,X-Request-ID,X-E2E-Test-Token,X-E2E-Source-IP"

Accept isn't in it → preflight 403 → browser blocks the POST with the generic "Failed to fetch" error.

Fix

Drop the Accept header. With only safelisted headers + credentials: 'include', the POST becomes a "simple cross-origin request" — no preflight required. The api returns JSON regardless of the request Accept value.

Test coverage block (rule 17)

Symptom: POST /auth/exchange returns net::ERR_FAILED in browser; CORS preflight 403 confirmed via curl
Enumeration: rg -nF 'corsAllowHeaders' internal/router/router.go (1 hit, allowlist excludes Accept)
Sites found: 1 (LoginCallbackPage.tsx exchangeCookieForToken)
Sites touched: 1
Coverage test: new regression guard asserts init.headers is undefined — catches any future reintroduction of Accept/Content-Type that would re-break the preflight
Live verified: will re-verify with chrome MCP after merge + GH Pages deploy

Why didn't #150 catch this

Unit tests mock fetch so they never exercise the real browser's CORS preflight logic. This is a class of bug that only surfaces in live cross-origin tests. CLAUDE.md rule 13 is explicit: "Live-URL gate. Every user-facing change ends with one of: (a) curl of the prod URL grep'd for the new SHA/content, (b) a real triggered email/webhook/job artifact, (c) explicit 'awaiting user verification of X'. Log greps DO NOT satisfy this gate." I treated npm run gate green as sufficient — that's the mistake.

🤖 Generated with Claude Code

[github-actions]

size-limit report 📦

Path	Size
dist/assets/index-CURDTYRC.js	0 B (-100% 🔽)
dist/assets/index-BsJUZYRr.css	6.13 KB (0%)
dist/assets/index-Di-yYCRi.js	163.67 KB (+100% 🔺)