feat(preview): carry the session token in the url fragment

[gwdp]

Why

A shared link carried the token as ?token=, so it reached the tunnel's access logs, any proxy in front of it, and any chat app that unfurled the link. That token opens a route that runs shell commands on the host.

How

• Share writes the token to the fragment, which browsers never send
• The gate still reads only a query token, so the 401 page converts the fragment and re-navigates; the server trades it for a cookie as before
• The client clears a fragment token on load, for a visit that already has the cookie
• The query form is kept supported

Stacked on #165. x-ref expo/eas-cli#4434.

Test Plan

• CI
• Browser: /#token=… sends no token on the first request, loads the preview, and leaves a clean address bar
• A wrong token in the fragment stops on the rejected page after one hop, no loop

[linear-code]

ENG-26905