fix: SW must not intercept cross-origin requests (backend API calls)

Added same-origin check so the SW only caches its own static assets.
Cross-origin requests (Navidrome API, NovaSonic backend) pass through
directly — SW interference was causing 'failed to fetch' in the PWA.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sw.js

@@ -1,6 +1,6 @@
-const CACHE = 'ns-v23';
+const CACHE = 'ns-v24';
 const PRECACHE = ['/', 'index.html', 'styles.css', 'app.js', 'manifest.json', 'icon.svg'];
-const SKIP_URLS = ['/rest/stream', '/rest/download', '/config.js'];
+const SKIP_PATHS = ['/rest/stream', '/rest/download', '/config.js'];
 
 self.addEventListener('install', e => {
   e.waitUntil(caches.open(CACHE).then(c => c.addAll(PRECACHE)));
@@ -18,7 +18,8 @@ self.addEventListener('activate', e => {
 });
 
 self.addEventListener('fetch', e => {
-  if (SKIP_URLS.some(u => e.request.url.includes(u))) return;
+  if (!e.request.url.startsWith(self.location.origin)) return;
+  if (SKIP_PATHS.some(p => e.request.url.includes(p))) return;
   e.respondWith(
     fetch(e.request)
       .then(res => {