Choose credential transport by how each route is invoked

Before gating an existing web API, classify routes by invocation: programmatic fetch, top-level navigation (pasted permalinks), navigator.sendBeacon, or server-to-server. Custom headers can't reach navigations or sendBeacon, which forces a ?key= query fallback that puts secrets in URLs. An HttpOnly session cookie rides on navigations and same-origin beacons, so it removes that fallback for browsers. Add the cookie as another accepted credential in the existing gate dependency so gated routes need no individual changes.