feat: add Endpoint.backend and a split-origin sample

[kachurun]

What it does

Lets a Theia frontend live on a different origin than the Node backend (CDN / host app + sandbox API).

Core:

• Endpoint.backend optionally points REST and WebSocket URLs at another origin. Explicit Endpoint.Options still win.
• Socket.IO client sends cookies (withCredentials). When THEIA_HOSTS is set, the Socket.IO server uses that list for CORS with credentials.
• File upload/download send cookies so they work across origins.
• Mini-browser hostname follows Endpoint.
• The frontend plugin worker inherits Endpoint.backend from its script URL and loads hostedPlugin from that origin.
  Sample (THEIA_SPLIT_ORIGIN=1, off by default — a normal npm start of the browser example is unchanged):
• npm run start:split serves a host page at http://localhost:8080/ and Theia static files under /theia/.
• Preload sets Endpoint.backend from ?backend= and POSTs /split-origin/session with Authorization: Bearer from ?token= before Socket.IO opens. A real app can assign Endpoint.backend at startup and skip the query string.
• Node does not serve the SPA. The connection cookie is minted only after a successful session POST; WebSocket, file transfer, and /mini-browser then require that cookie.
• Demo token is S3Cr3t (THEIA_SPLIT_ORIGIN_TOKEN). Wrong or missing token will show loading indicator, session POST returns 401.

Related use cases

• Is it possible to host theia-front end and back-end on two different machines? #8827 requested a sample with the frontend and backend hosted separately.
• An Idea for Remote Development Connectivity #16188 requested connecting a browser frontend to a backend on another host.
• Show theia only inside IFrame #6844 and Document secure deployment and security measures #9322 discuss authenticated embedded deployments and WebSocket/CORS security.

How to test

npm run build:browser
npm run start:split

1. Open http://localhost:8080/. Confirm the host page at / embeds Theia from /theia/?backend=http://localhost:3000&token=S3Cr3t.
2. Workbench loads, WS connects, explorer / editor work. :3000 must not serve the SPA.
3. Open a file preview (mini-browser) and upload/download a file — both should hit the backend origin with cookies.
4. Open the SPA URL with a wrong or missing token. Session POST returns 401, socket does not open.

Follow-ups

Breaking changes

• This PR introduces breaking changes and requires careful review. If yes, the breaking changes section in the changelog has been updated.

Attribution

Review checklist

• As an author, I have thoroughly tested my changes and carefully followed the review guidelines
• User-facing text is internationalized using the nls service (for details, please see the Internationalization/Localization section in the Coding Guidelines)

Reminder for reviewers

• As a reviewer, I agree to behave in accordance with the review guidelines

[kachurun]

@sdirix @ndoschek Sorry to bother you, guys, but could you please take a look?