egutierrez
294905984c
A browser signs every control-plane request with X-Unibus-Pub/Ts/Nonce/Sig (busauth.signedHeaders). The CORS Allow-Headers only listed Content-Type and Authorization, so the browser's preflight rejected the real request and the SPA failed with 'Failed to fetch' on the first authenticated call (listRooms). Add the four X-Unibus-* headers to Access-Control-Allow-Headers. This was invisible to the Node smoke (fetch in Node does no CORS preflight); only a real browser surfaced it. Verified live: enmanuel logs into uniweb against the cluster and lists rooms. Regression test asserts the header is present.