fix: ABS proxy via backend to bypass CORS + settings button layout

- Add /api/abs-proxy/* endpoint in the backend that forwards all ABS API
  calls server-side (X-ABS-URL + X-ABS-Token headers). Browser never
  touches ABS directly for API calls — no CORS issue.
- abs.js routes through proxy when backendUrl is set; falls back to direct
  if no backend (requires user to configure CORS on ABS server)
- Audio streaming still uses direct <audio src> (HTML media bypasses CORS)
- Settings: status text above buttons, buttons full-width flex row

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/abs.js

@@ -2,12 +2,30 @@ import { S } from './state.js';
 import { esc, toast } from './utils.js';
 
 // ─── HTTP HELPERS ───
+// API calls are routed through the NovaSonic backend proxy to avoid CORS restrictions.
+// Audio streaming uses <audio src> directly (HTML media elements bypass CORS).
 async function absRequest(method, path, body) {
-  const headers = { 'Content-Type': 'application/json' };
-  if (S.abs.token) headers['Authorization'] = `Bearer ${S.abs.token}`;
+  const backend = S.cfg.backendUrl;
+  let url, headers;
+
+  if (backend) {
+    // Proxy through NovaSonic backend — no CORS issue
+    url = `${backend}/api/abs-proxy${path}`;
+    headers = {
+      'Content-Type':  'application/json',
+      'X-ABS-URL':     S.abs.url,
+      'X-ABS-Token':   S.abs.token || '',
+    };
+  } else {
+    // Direct — requires CORS to be configured on the ABS server
+    url = `${S.abs.url}${path}`;
+    headers = { 'Content-Type': 'application/json' };
+    if (S.abs.token) headers['Authorization'] = `Bearer ${S.abs.token}`;
+  }
+
   const opts = { method, headers };
   if (body !== undefined) opts.body = JSON.stringify(body);
-  const res = await fetch(`${S.abs.url}${path}`, opts);
+  const res = await fetch(url, opts);
   if (!res.ok) {
     const txt = await res.text().catch(() => '');
     throw new Error(`ABS ${method} ${path}: HTTP ${res.status} ${txt.slice(0, 120)}`);