修复中控内嵌：跨站 Cookie 被拦时用 embed_sso 维持登录。

SSO 写入 sessionStorage，fetch 自动带 X-Hub-Embed-SSO，避免期权链 API 401。

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/hub/hub_bridge_register.py

@@ -4,10 +4,13 @@ from __future__ import annotations
 from typing import Any
 
 from flask import Flask, jsonify, redirect, request, session
+from urllib.parse import quote
 
 from lib.hub.hub_bridge_auth import (
     frame_ancestors_header_value,
+    hub_bridge_token,
     hub_bridge_token_ok,
+    make_embed_session_token,
     verify_sso_token,
 )
 
@@ -123,7 +126,11 @@ def register_hub_bridge_routes(app: Flask, app_module: Any) -> None:
             )
         session["logged_in"] = True
         session.permanent = True
-        return redirect(next_path)
+        session.modified = True
+        # iframe 跨站时常丢 Cookie:附带可放入 sessionStorage 的 embed_sso
+        embed_tok = make_embed_session_token(hub_bridge_token(), ttl_sec=604800)
+        joiner = "&" if "?" in next_path else "?"
+        return redirect(f"{next_path}{joiner}embed_sso={quote(embed_tok, safe='')}")
 
     @app.after_request
     def _hub_frame_ancestors(resp):