Structured-content preview/publish 401s on auth-enabled sites (window.open can't send Authorization header to da-sc)

## Summary
Preview/Publish for structured content in the `/form` editor 401s when the site has EDS authentication enabled (https://www.aem.live/docs/authentication-setup-site).

Reported in Slack: https://cq-dev.slack.com/archives/C08B6C02EPM/p1787596745867289
Repro: cisco-it-digital-workplace/ix-deploy, e.g.
- https://da-sc.adobeaem.workers.dev/preview/cisco-it-digital-workplace/ix-deploy/bridge/schemas/modals/lightbox-config
- https://da-sc.adobeaem.workers.dev/live/cisco-it-digital-workplace/ix-deploy/bridge/schemas/modals/lightbox-config

## Root cause
`nx2/blocks/ew-actions/ew-actions.js` — the "Send" button (Preview/Publish) that wraps the `/form` structured-content editor:
- `_runAemAction` calls the AEM admin preview/publish API, then `_resolveOpenUrl` (lines ~217-229) resolves the URL to open: a `preview-url`/`live-url` `` template when the site defines one (BYO-origin override), else the AEM admin response URL.
- The resolved URL is opened with `window.open(url, url)` — a plain browser navigation to view the structured-content document as JSON via the `da-sc` delivery endpoint.
- Browser navigations cannot set custom request headers. `da-sc` (adobe-rnd/da-sc `src/index.ts`) only authenticates via `Authorization: token ` forwarded from the incoming request — it has no cookie/session concept. Since that header can never be attached to a `window.open` navigation, any site whose `preview-url`/`live-url` meta points at `da-sc.adobeaem.workers.dev` 401s once site auth is enabled.
- This differs from normal `aem.page`/`aem.live` navigation, which authenticates via an interactive session cookie scoped to that origin — no equivalent flow exists for `da-sc`.

## Impact
Any auth-enabled site relying on the preview/live URL override to view structured-content documents via `da-sc` cannot preview or verify a publish from the UI — it 401s every time.

## Possible directions (not prescriptive)
- Support a cookie/session-based auth flow on `da-sc` mirroring aem.live's interactive login, so plain navigation works, or
- Route this preview through an authenticated fetch (rendering the JSON in-app) instead of a bare `window.open` to the delivery origin, or
- Document that `preview-url`/`live-url` overrides pointing at token-only origins are incompatible with EDS site auth today.

## Out of scope
`da-sc` itself behaves correctly for callers that already carry an `Authorization: token ` header (e.g. server-side/fetch-based consumers) — no change needed there.

Start in nx2/blocks/ew-actions/ew-actions.js, reading _runAemAction and _resolveOpenUrl and how the Send button opens preview or publish URLs. Then inspect the authentication path in da-sc/src/index.ts and existing navigation or fetch tests. Done means an auth-enabled site can preview and publish structured content without a 401; the issue leaves the implementation direction to be chosen.

Written by the indexing model from the issue text.