Build and browser-verify the tenant-picker frontend page

web/src/routes/select-tenant now calls enterprise-auth's existing
GET /auth/memberships / POST /auth/select-tenant protocol (built earlier
this phase, previously called only from Go tests) via
fetch(..., {credentials: 'include'}) -- new listMemberships/selectTenant
functions in $lib/api.ts, using a dedicated request helper that reads
plain-text error bodies (loginhandler's http.Error responses), unlike
every other request helper in that file which expects JSON.

Credentialed cross-origin fetch needed CORS enterprise-auth didn't have:
api/httpserver.WithCORS's wildcard-friendly default can't be combined
with a credentialed request at all (browsers refuse to honor
Access-Control-Allow-Origin: "*" on one) -- added WithCredentialedCORS
(literal origin, Access-Control-Allow-Credentials: true) alongside it,
wired into enterprise-auth via a new CORS_ALLOWED_ORIGIN config var
defaulting to POST_LOGIN_REDIRECT_URL (web's own origin, the same
default pattern SELECT_TENANT_REDIRECT_URL already used).

adapter-static's route crawler doesn't discover a page nothing links to
(this one is only ever reached via enterprise-auth's redirect) -- fixed
with select-tenant/+page.ts's `export const prerender = true`, the same
declaration every other route already has.

Genuinely verified in a real browser in this environment, not just
type-checked: a throwaway Node server standing in for enterprise-auth's
exact wire contract (including its plain-text error bodies), driven
through the full flow via mcp__claude-in-chrome -- cross-origin
pending-login cookie set, credentialed preflight + GET/POST round trip,
a real click choosing a tenant, the post-selection redirect, and the
missing/expired-cookie error path rendering the backend's actual
message. No Docker or live Postgres/IdP needed, since the point was
exercising web's own fetch/CORS/cookie wiring, not enterprise-auth's
internals (already covered by loginhandler's own tests).

This closes the tenant-picker as the last named gap in Phase 4. What's
left is the already-disclosed live-verification caveat shared by every
Postgres/ClickHouse-backed piece and both SSO protocols: none of this
has run against a real database, external IdP, or multi-container
deployment in this environment.

enterprise/internal/config/config.go

@@ -20,13 +20,21 @@ type Config struct {
 	// SelectTenantRedirectURL is where the browser lands after a login
 	// resolves to more than one tenant_memberships row --
 	// internal/loginhandler issues a pending-login cookie and sends the
-	// browser here instead of straight to PostLoginRedirectURL. Nothing
-	// serves this route yet (a real tenant-picker page is undesigned
-	// frontend work -- see internal/loginhandler's package doc comment);
-	// the backend protocol (GET /auth/memberships, POST
-	// /auth/select-tenant) is complete and independently testable via
-	// HTTP regardless of what, if anything, is listening here today.
+	// browser here. web/src/routes/select-tenant is the page that serves
+	// it (see that route's own comments) -- it calls GET
+	// /auth/memberships and POST /auth/select-tenant with
+	// `credentials: 'include'`, which is why CORSAllowedOrigin below has
+	// to be a literal origin, not WithCORS's zero-config "*" default.
 	SelectTenantRedirectURL string
+	// CORSAllowedOrigin is passed to httpserver.WithCredentialedCORS, not
+	// the plain httpserver.WithCORS every other service in this repo
+	// uses -- GET /auth/memberships / POST /auth/select-tenant are
+	// cookie-carrying requests (the pending-login cookie, then the real
+	// session cookie), and browsers categorically refuse to combine a
+	// credentialed fetch with an Access-Control-Allow-Origin: "*"
+	// response, so this can't default to the wildcard the way
+	// api/internal/config.CORSAllowedOrigin does.
+	CORSAllowedOrigin string
 }
 
 type PostgresConfig struct {
@@ -84,8 +92,11 @@ func Load() (Config, error) {
 	// computed after cfg.PostLoginRedirectURL above so a caller
 	// overriding just POST_LOGIN_REDIRECT_URL still gets a sensible
 	// SelectTenantRedirectURL without also having to set the new
-	// variable.
+	// variable. CORSAllowedOrigin defaults the same way: web's own
+	// origin is exactly what needs credentialed cross-origin access to
+	// this service.
 	cfg.SelectTenantRedirectURL = getenv("SELECT_TENANT_REDIRECT_URL", cfg.PostLoginRedirectURL+"/select-tenant")
+	cfg.CORSAllowedOrigin = getenv("CORS_ALLOWED_ORIGIN", cfg.PostLoginRedirectURL)
 
 	// Required, unlike OIDC/SAML above: every enterprise-auth deployment
 	// issues and validates session/service tokens (internal/session),