feat: swipe-up player bar opens Now Playing; fix backend CORS for reverse proxy

- Add touchstart/touchend on .player bar: swipe up ≥40px or fast flick opens np-overlay
- Replace cors() package with explicit middleware that sets Access-Control-Allow-Origin/Methods/Headers and Access-Control-Allow-Private-Network (needed for Chrome when backend is on private network or behind proxy)
- Remove cors npm dependency from backend
- Bump cache to ns-v20

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.js

@@ -125,6 +125,22 @@ window.addEventListener('load',()=>{
   // Now Playing: click player-art to open
   const pa=document.getElementById('player-art');
   if(pa)pa.addEventListener('click', openNowPlaying);
+  // Swipe-up on player bar to open Now Playing
+  const playerBar=document.querySelector('.player');
+  if(playerBar){
+    let _sy=0,_st=0;
+    playerBar.addEventListener('touchstart',e=>{
+      if(e.target.closest('button')||e.target.closest('.progress-bar')||e.target.closest('.volume-wrap'))return;
+      _sy=e.touches[0].clientY;_st=Date.now();
+    },{passive:true});
+    playerBar.addEventListener('touchend',e=>{
+      if(!_sy)return;
+      const dy=_sy-e.changedTouches[0].clientY;
+      const dt=Date.now()-_st;
+      if(dy>40||(dt<300&&dy>15))openNowPlaying();
+      _sy=0;
+    },{passive:true});
+  }
 });
 
 async function startApp(){