fix(web): preserve preview session during builds

[iamjr15]

Summary

• keep the hidden preview-session exchange mounted while the branded build loader covers the starter scaffold
• exchange the one-minute preview URL handoff for the renewable host cookie before long-running app builds finish
• document the loader/session boundary

Decision

The preview iframe must stay unmounted until generated content is ready, but authorization cannot wait that long because URL handoffs expire after 60 seconds. The existing hidden session-refresh iframe now runs behind the loader, preserving the security boundary without exposing starter content.

Verification

• pnpm turbo skills:build
• pnpm turbo typecheck lint build (55/55 tasks)
• production reproduction confirmed the branded loader stayed visible while the original handoff expired, which this change directly prevents by performing the documented cookie exchange during that state