perf(E): preconnect api.worldmonitor.app (-680 ms LCP) (#4003)

* perf(E): preconnect api.worldmonitor.app + Sentry, dns-prefetch Clerk

Closes #3992. Parent: #3987.

Add three head-hygiene hints for first-paint critical origins:
- preconnect api.worldmonitor.app (crossorigin) — origin hit by every
  initial data fetch; Lighthouse estimates ~680 ms LCP savings
- preconnect o4509927897890816.ingest.us.sentry.io (crossorigin) —
  Sentry ingest host (verified against VITE_SENTRY_DSN); ~310 ms savings
- dns-prefetch clerk.worldmonitor.app — low-cost backup for auth host
  hit when Clerk lazy-loads via requestIdleCallback (per #3999)

Existing preconnects (maps.worldmonitor.app, protomaps.github.io,
fonts.googleapis.com, fonts.gstatic.com) are left in place — fonts are
used immediately by the stylesheet on line 275, and the map origins are
reached when MapContainer hydrates. Without a fresh Lighthouse audit to
confirm which are flagged "unused", erring on the side of leaving them
alone per the issue's guidance ("if ambiguous, leave alone").

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: use crossorigin="use-credentials" for api.worldmonitor.app preconnect

Greptile flagged that runtime.ts:765 defaults all api.worldmonitor.app
fetches to credentials: 'include'. With crossorigin (anonymous) the
pre-opened socket lives in a different connection pool than the
credentialed fetches and gets silently discarded — negating the LCP
benefit. crossorigin="use-credentials" puts the preconnect in the same
pool the fetches actually reuse.

Sentry stays anonymous (DSN key in headers, no cookies).
Clerk is dns-prefetch only — crossorigin is ignored on dns-prefetch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>