feat: detect CORS errors and show actionable guidance on login

Distinguish CORS-blocked requests from genuine network failures using
a no-cors probe, so users deploying via Docker see a specific message
pointing to their JMAP server's CORS settings instead of a misleading
"unable to reach the server" error.

stores/auth-store.ts

@@ -98,7 +98,9 @@ export const useAuthStore = create<AuthState>()(
           let errorKey = 'generic';
 
           if (error instanceof Error) {
-            if (error.message.includes('Invalid username or password') ||
+            if (error.message === 'CORS_ERROR') {
+              errorKey = 'cors_blocked';
+            } else if (error.message.includes('Invalid username or password') ||
                 error.message.includes('401') ||
                 error.message.includes('Unauthorized')) {
               errorKey = 'invalid_credentials';