fix(server): let cross-site link clicks reach the app shell

The global Sec-Fetch-Site gate rejected cross-site top-level navigations, so opening the deployed URL from a dashboard, chat, or email rendered the INVALID_ORIGIN JSON error instead of the app. Allow safe GET/HEAD document navigations to non-API paths; API calls and sub-resource loads stay same-origin, and mutations still require JSON plus the session token.