Cherry-pick 7 pixel-art sprites from feat/pet-ui-v1 (PR #16) — cat
(idle/happy/think/sleep), dog-idle, owl-idle, blob-idle — into
cortex-ui public dir so the PetEditor view renders a visual pet
instead of a bare JSON dump.
## Behavior
- Species inferred from first letter of pet_name:
- 'd*' → dog, 'o*' → owl, 'b*' → blob, else → cat (default,
has 4 mood states)
- Mood switcher: click idle / happy / think / sleep → swaps sprite
- image-rendering: pixelated for crisp pixel-art scaling
- 32×32 native scaled to 128×128 (4x) with nearest-neighbor
## Why now
User tested the UI end-to-end, confirmed auth+CORS+whitespace fix
works, then asked for the cat. The sprite-gen commit (PR #16) is
still unmerged but sprites are sibling static assets — safe to copy
into cortex-ui without blocking on PR merge. Ownership stays with
the sprite-gen branch; cortex-ui just embeds the artefacts.
Rebuild hash: index-RLWTBoLo.js + index-BzERxlis.css.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Live e2e test caught a paste-inserted whitespace in URL token param —
copy-paste from terminal had inserted %20%20%20 into middle of the
64-char hex token, which passed URL parsing but failed byte-level
auth::tokens_match on the daemon → 403.
Two fixes:
1. `sanitize_token()` strips ALL whitespace (spaces, tabs, newlines,
zero-width) from token before use, applied on both URL-param and
localStorage read paths. Defensive even against future Setup-form
paste mishaps — Setup input itself could also be whitespace-dirty.
2. `credentials: 'include'` → `credentials: 'omit'`. Bearer auth rides
on an explicit header; we don't need cookies. `include` triggers
browser quirks (Safari especially) around credentialed cross-origin
fetches that can strip or mismangle Authorization on redirects.
3. Error message now includes response body preview — `"403 Forbidden
— {\"error\":{\"code\":\"forbidden\",\"message\":\"bearer token
rejected\"}}"` — so the next failing setup surfaces root-cause.
Tests unchanged (10 passing). Rebuild hash: index-7ZqAoBoM.js.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
