fix(vidstack): resolve thumbnail cross-origin before creating loader

[Rafatcb]

Related:

None.

Description:

Thumbnail.onSetup created the ThumbnailsLoader before #watchCrossOrigin() had resolved the effective cross-origin value. Effects run synchronously on creation, so the loader's first run read the initial state (null) and fetched the storyboard with credentials: 'same-origin'; when the watcher then set the real value, the effect re-ran and fetched again: two requests per mount, the first one failing with 403 for cookie-protected media.

Swapping the two lines makes the loader read the correct value on its first run, matching the order SliderVideo already uses. SliderThumbnail is covered too, since it extends Thumbnail.

Added thumbnail-cross-origin.test.ts: it mounts a Thumbnail with the media's crossOrigin set to use-credentials and asserts a single fetch with credentials: 'include'. Without the fix it fails with two calls.

Ready?

Yes.

Anything Else?

Nothing.

Review Process:

1. pnpm -F vidstack sandbox.
2. Open DevTools > Network, filter by storyboard.vtt and clear the list.
3. Click the Video source button.

Before: two requests. After: one.