feat: sample site and CORS for widget API routes (#31)

[WanKim00]

What

• Add a sample partner site (sample-site/) served on a different origin (pnpm sample-site → http://localhost:4000)
• Add a plain-JS widget experiment (public/widget-test.js) that calls the ITS API cross-origin with the site tag
• Add server/middleware/widget-cors.ts: enables CORS only for widget routes (/api/health, /api/widget/**)
• Add /api/widget to PUBLIC_PREFIXES in server/middleware/auth.ts so widget routes skip the session check

How to test

1. pnpm dev (ITS on :3000)
2. pnpm sample-site (sample site on :4000)
3. Open http://localhost:4000, click the blue button
4. Console shows [ITS widget] Server response: {...} with no CORS errors
5. curl -i http://localhost:3000/api/users still returns 401 with no CORS headers

Part of #31
Refs #19