Build and browser-verify the tenant-picker frontend page

web/src/routes/select-tenant now calls enterprise-auth's existing
GET /auth/memberships / POST /auth/select-tenant protocol (built earlier
this phase, previously called only from Go tests) via
fetch(..., {credentials: 'include'}) -- new listMemberships/selectTenant
functions in $lib/api.ts, using a dedicated request helper that reads
plain-text error bodies (loginhandler's http.Error responses), unlike
every other request helper in that file which expects JSON.

Credentialed cross-origin fetch needed CORS enterprise-auth didn't have:
api/httpserver.WithCORS's wildcard-friendly default can't be combined
with a credentialed request at all (browsers refuse to honor
Access-Control-Allow-Origin: "*" on one) -- added WithCredentialedCORS
(literal origin, Access-Control-Allow-Credentials: true) alongside it,
wired into enterprise-auth via a new CORS_ALLOWED_ORIGIN config var
defaulting to POST_LOGIN_REDIRECT_URL (web's own origin, the same
default pattern SELECT_TENANT_REDIRECT_URL already used).

adapter-static's route crawler doesn't discover a page nothing links to
(this one is only ever reached via enterprise-auth's redirect) -- fixed
with select-tenant/+page.ts's `export const prerender = true`, the same
declaration every other route already has.

Genuinely verified in a real browser in this environment, not just
type-checked: a throwaway Node server standing in for enterprise-auth's
exact wire contract (including its plain-text error bodies), driven
through the full flow via mcp__claude-in-chrome -- cross-origin
pending-login cookie set, credentialed preflight + GET/POST round trip,
a real click choosing a tenant, the post-selection redirect, and the
missing/expired-cookie error path rendering the backend's actual
message. No Docker or live Postgres/IdP needed, since the point was
exercising web's own fetch/CORS/cookie wiring, not enterprise-auth's
internals (already covered by loginhandler's own tests).

This closes the tenant-picker as the last named gap in Phase 4. What's
left is the already-disclosed live-verification caveat shared by every
Postgres/ClickHouse-backed piece and both SSO protocols: none of this
has run against a real database, external IdP, or multi-container
deployment in this environment.

web/src/lib/api.ts

@@ -149,6 +149,60 @@ export async function getAuthFeatures(): Promise<AuthFeatures> {
 	}
 }
 
+// --- tenant picker (Phase 4) -------------------------------------------
+//
+// The two calls below are the reason getAuthFeatures above doesn't send
+// credentials but these do: they carry the short-lived
+// sentry_pending_login cookie enterprise-auth's finishLogin sets when an
+// identity resolves to more than one tenant_memberships row (see
+// enterprise/internal/loginhandler's package doc comment), and
+// selectTenant's response sets the real session cookie. Both require
+// `credentials: 'include'`, which is exactly why enterprise-auth's CORS
+// (httpserver.WithCredentialedCORS) can't use getAuthFeatures'/api.ts's
+// other requests' wildcard-friendly posture -- browsers refuse to honor
+// Access-Control-Allow-Origin: "*" on a credentialed request at all, so
+// CORS_ALLOWED_ORIGIN has to name this page's real origin.
+
+export type Membership = { tenant_id: string; tenant_display_name: string; role: string };
+
+class TenantPickerError extends Error {}
+
+// enterprise-auth's loginhandler responds to an error with plain
+// http.Error text (e.g. "no membership in the requested tenant"), not a
+// JSON {"error": "..."} body the way /api's queryapi/dashboards handlers
+// do -- requestFrom's JSON-body error parsing wouldn't surface that
+// message, so this reads the body as plain text instead.
+async function enterpriseAuthRequest<T>(path: string, init?: RequestInit): Promise<T> {
+	if (!enterpriseAuthBase) {
+		throw new TenantPickerError('enterprise-auth is not configured (VITE_ENTERPRISE_AUTH_BASE_URL unset)');
+	}
+	const res = await fetch(`${enterpriseAuthBase}${path}`, {
+		credentials: 'include',
+		headers: { 'Content-Type': 'application/json' },
+		...init
+	});
+	if (!res.ok) {
+		const body = await res.text();
+		throw new TenantPickerError(body || `request failed with status ${res.status}`);
+	}
+	return res.json();
+}
+
+// listMemberships backs the tenant-picker page's initial load -- see
+// web/src/routes/select-tenant. A 400/401 (missing or expired pending
+// login) surfaces as a thrown TenantPickerError; the page's own error
+// state is what tells the user to start over at login.
+export function listMemberships(): Promise<Membership[]> {
+	return enterpriseAuthRequest('/auth/memberships');
+}
+
+export function selectTenant(tenantId: string): Promise<{ redirect_url: string }> {
+	return enterpriseAuthRequest('/auth/select-tenant', {
+		method: 'POST',
+		body: JSON.stringify({ tenant_id: tenantId })
+	});
+}
+
 export function exportDashboard(id: string): Promise<Dashboard> {
 	return request(`/dashboards/${id}/export`);
 }