fix: strip crossorigin from HTML for WKWebView child windows + status bar

Tool windows (still closing instantly with CSP=null):
- Root cause: Vite adds crossorigin attribute to <script> and <link> tags
  in index.html. This forces CORS mode for resource loading. WKWebView's
  Tauri custom protocol handler (tauri://) may not return proper CORS
  headers for child WebviewWindows, causing the module script to fail
  to load and the window to close immediately.
- Fix: Vite plugin strips crossorigin from built HTML via transformIndexHtml
- Also set crossOriginLoading: false for Rollup output chunks

Status bar:
- h-[48px] text-base px-6 — 48px height with 16px text, explicit pixel
  value to avoid Tailwind spacing ambiguity

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/components/common/StatusBar.vue

@@ -1,5 +1,5 @@
 <template>
-  <div class="h-10 flex items-center justify-between px-4 bg-[var(--wraith-bg-secondary)] border-t border-[var(--wraith-border)] text-sm text-[var(--wraith-text-muted)] shrink-0">
+  <div class="h-[48px] flex items-center justify-between px-6 bg-[var(--wraith-bg-secondary)] border-t border-[var(--wraith-border)] text-base text-[var(--wraith-text-muted)] shrink-0">
     <!-- Left: connection info -->
     <div class="flex items-center gap-3">
       <template v-if="sessionStore.activeSession">

vite.config.ts

@@ -1,10 +1,20 @@
-import { defineConfig } from "vite";
+import { defineConfig, type Plugin } from "vite";
 import vue from "@vitejs/plugin-vue";
 import tailwindcss from "@tailwindcss/vite";
 import { resolve } from "path";
 
+/** Strip crossorigin attribute from HTML — WKWebView + Tauri custom protocol compatibility. */
+function stripCrossOrigin(): Plugin {
+  return {
+    name: "strip-crossorigin",
+    transformIndexHtml(html) {
+      return html.replace(/ crossorigin/g, "");
+    },
+  };
+}
+
 export default defineConfig({
-  plugins: [vue(), tailwindcss()],
+  plugins: [vue(), tailwindcss(), stripCrossOrigin()],
   resolve: {
     alias: {
       "@": resolve(__dirname, "src"),
@@ -23,5 +33,9 @@ export default defineConfig({
     target: ["es2021", "chrome100", "safari13"],
     minify: !process.env.TAURI_DEBUG ? "esbuild" : false,
     sourcemap: !!process.env.TAURI_DEBUG,
+    // Disable crossorigin attribute on script/link tags — WKWebView on
+    // macOS may reject CORS-mode requests for Tauri's custom tauri://
+    // protocol in dynamically created child WebviewWindows.
+    crossOriginLoading: false,
   },
 });