Guest SVG previews fail when Web and API use different origins #3834

Initial Checklist

• I understand this is a bug report and questions should be posted in the Community Discussions
• I searched issues and couldn’t find anything (or linked relevant results below)

Bug Description

Guest SVG previews fail when Web and the API use different origins. Follow-up to #3816; exploratory findings.

Reproduction Steps

1. Serve Web at https://host.docker.internal:9201 and the API at https://host.docker.internal:9200, with credentialed CORS configured.
2. Invite a guest to an SVG file or a folder containing one.
3. Redeem the invitation and open the SVG in Preview.
4. Compare with an equivalent Public Link.

Tested with Chromium, Firefox and WebKit, backend rolling 8.1.0+40095460.

Expected Outcome

The SVG renders for both Guests and Public Links.

Actual Outcome

The Guest preview is blank. vue-inline-svg requests the protected DAV URL without the guest cookie and receives 401. The Public Link renders correctly. Guest preview also works when Web and API share an origin.