fix: remove credentials:include from REST requests — OSC proxy omits Allow-Credentials header

Catalog service instances on OSC do not propagate Access-Control-Allow-Credentials,
so credentials:include caused CORS failures for all REST calls from the deployed studio.
REST auth still uses Authorization header; WebSocket auth uses the OSC cookie set by sat.ts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

src/lib/api.ts

@@ -9,7 +9,6 @@ async function request<T>(path: string, init?: RequestInit): Promise<T> {
   const contentHeaders: Record<string, string> = init?.body !== undefined ? { 'Content-Type': 'application/json' } : {}
 
   const res = await fetch(`${BASE}${path}`, {
-    credentials: isOnOsc() ? 'include' : 'same-origin',
     headers: { ...contentHeaders, ...authHeaders },
     ...init,
   })

src/pages/ControllerPage/TimerBar.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useRef, useState, useCallback } from 'react'
 import { BASE } from '@/lib/api'
-import { authenticateWithOpenLive, getApiToken, isOnOsc } from '@/lib/sat'
+import { authenticateWithOpenLive, getApiToken } from '@/lib/sat'
 import { useProgramStartMs, getProgramMode, COUNTDOWN_WINDOW_MS, PROGRAM_WINDOW_MS } from '@/store/programClock.store'
 import { useProductionStore } from '@/store/production.store'
 import { useProductionsStore } from '@/store/productions.store'
@@ -14,7 +14,7 @@ async function fetchServerOffset(): Promise<number> {
     const res = await fetch(`${BASE}/api/v1/ping`, {
       method: 'HEAD',
       cache: 'no-store',
-      credentials: isOnOsc() ? 'include' : 'same-origin',
+      credentials: 'same-origin',
       headers: token ? { Authorization: `Bearer ${token}` } : {},
     })
     const after = Date.now()