fix: remove crossOrigin use-credentials from entry script (#100)

The crossOrigin = 'use-credentials' attribute on the entry module script
causes CORS issues when the app-loader is used cross-origin (e.g. in
Canvas preview iframes). Removing it restores the default browser
behavior which works correctly for cross-origin module scripts.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: fago

src/runtime/server/api/app-loader.js.get.ts

@@ -83,7 +83,6 @@ export default defineEventHandler((event) => {
       // Load entry module
       const entry = document.createElement('script');
       entry.type = 'module';
-      entry.crossOrigin = 'use-credentials';
       entry.src = '${entryPathValue}';
       document.head.appendChild(entry);
     }