Hosted AI consent now recognizes its secure window

Secure hosted windows work as intended

Hosted clients deliberately give their authorization window an opaque browser origin. Miracle now accepts that window only when the browser also supplies its protected same-origin fetch signal.

Cross-site forms still fail closed

An arbitrary origin, a cross-site request, a missing browser signal, or any unreviewed callback still fails before a consent request can be used.