feat: swipe-up player bar opens Now Playing; fix backend CORS for reverse proxy

- Add touchstart/touchend on .player bar: swipe up ≥40px or fast flick opens np-overlay
- Replace cors() package with explicit middleware that sets Access-Control-Allow-Origin/Methods/Headers and Access-Control-Allow-Private-Network (needed for Chrome when backend is on private network or behind proxy)
- Remove cors npm dependency from backend
- Bump cache to ns-v20

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -15,7 +15,6 @@
  */
 
 const express = require('express');
-const cors    = require('cors');
 const { spawn, execSync } = require('child_process');
 const path    = require('path');
 const fs      = require('fs');
@@ -33,7 +32,14 @@ const CONFIG = {
 
 // ─── INIT ─────────────────────────────────────────────────────────────────────
 const app = express();
-app.use(cors());
+app.use((req,res,next)=>{
+  res.setHeader('Access-Control-Allow-Origin','*');
+  res.setHeader('Access-Control-Allow-Methods','GET,POST,OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers','Content-Type,Authorization');
+  res.setHeader('Access-Control-Allow-Private-Network','true');
+  if(req.method==='OPTIONS'){res.sendStatus(204);return;}
+  next();
+});
 app.use(express.json());
 
 // In-memory job store