[Bccorb]

Refs #177. Part of the v0.19 release (fells-code/seamless-auth-api#385).

What

In bearer transport, a request that carries a token (authorizedFetch and adapter calls):

• asks fetch for redirect: 'manual' and follows a redirect itself only when the target is apiHost or a trustedOrigins entry, up to five hops, with fetch's method rules (303, or 301/302 after a POST, becomes a GET without a body)
• rejects any other redirect with a new UntrustedRedirectError (exported from client, react and react-native) without sending the token on
• rejects a browser's opaque manual redirect, whose target cannot be judged
• where the platform follows redirects regardless (React Native's fetch), rejects a response that redirected to another origin. The token may already have gone on that platform, which is why the iOS check below matters
• leaves a caller's explicit redirect alone, with the final-origin check still applied

Requests without a token and cookie transport are unchanged. Client minor changeset, since redirect-following behaviour changes.

Checks

• npm run lint, npm run format:check, npm run typecheck: pass
• npm test: 45 suites, 604 tests (Jest) and 41 (Vitest) pass, 8 new redirect cases
• npm run build, npm run check-npm-build: pass
• Real networking, Node 24 fetch against two local servers: a 302 to the other origin rejects with UntrustedRedirectError and that server received no request; a same-origin 302 is followed with Authorization kept

Not done (why this says Refs, not Closes)

#177's done-when also asks to verify iOS NSURLSession on a device or simulator against a 302 to another origin. That needs a React Native build; it is left open on the issue.