fix(frontend): use URL origin for fetch/EventSource to support reverse proxy auth

When Hermes WebUI runs behind a reverse proxy with HTTP basic auth
(e.g. Caddy basic_auth), browsers embed credentials in the page URL.
The Fetch API and EventSource reject requests constructed from URLs
that include credentials (per Fetch spec, all modern browsers).

Fix: construct all fetch() and EventSource URLs via
new URL(path, location.origin) which strips credentials from the
base URL. Add credentials:"include" to ensure auth headers are
forwarded on each request.

static/workspace.js

@@ -1,5 +1,6 @@
 async function api(path,opts={}){
-  const res=await fetch(path,{headers:{'Content-Type':'application/json'},...opts});
+  const url=new URL(path,location.origin);
+  const res=await fetch(url.href,{credentials:'include',headers:{'Content-Type':'application/json'},...opts});
   if(!res.ok)throw new Error(await res.text());
   const ct=res.headers.get('content-type')||'';
   return ct.includes('application/json')?res.json():res.text();