fix(client): authorizedFetch refuses every path when apiHost is empty (same-origin apps) #188

What happens

Since #175 (client 0.5.0, react 0.16.0), authorizedFetch refuses any path when apiHost is "", which is the documented setup for an app that serves /auth itself on its own origin (the Next.js starter's <AuthProvider apiHost="">). It rejects with UntrustedOriginError and sends nothing.

Reproduced against the published @seamless-auth/client@0.5.0:

const client = createSeamlessAuthClient({ apiHost: '', fetch });
await client.authorizedFetch('/api/beta-users');
// UntrustedOriginError: authorizedFetch sends the session only to apiHost and trustedOrigins, and /api/beta-users is neither...

Found by the conformance suite: the Next.js starter's role-gated /api/beta-users call fails on react 0.16 (fells-code/seamless-templates#124), so the starter stays on 0.15 until this is fixed.

Why

The client prefixes a path with apiHost before the origin check (packages/client/src/transport.ts, refuseUntrusted). With an empty apiHost the path stays relative, originOf returns null for a relative URL, and the check refuses it. An empty apiHost also adds nothing to the trusted set.

Fix

• In a browser, treat an empty apiHost as the page's own origin: resolve paths against globalThis.location.origin and trust that origin
• Where there is no location (server rendering, React Native), keep refusing, with an error that says to set apiHost
• Tests for both, plus a same-origin case in the conformance matrix (the Next.js starter's roles spec already covers it once the starter moves to 0.16)

Done when

A same-origin app on the current SDK can call its own API with authorizedFetch('/path'), and the Next.js starter moves to the fixed version (fells-code/seamless-templates#123).