feat: swipe-up player bar opens Now Playing; fix backend CORS for reverse proxy

- Add touchstart/touchend on .player bar: swipe up ≥40px or fast flick opens np-overlay
- Replace cors() package with explicit middleware that sets Access-Control-Allow-Origin/Methods/Headers and Access-Control-Allow-Private-Network (needed for Chrome when backend is on private network or behind proxy)
- Remove cors npm dependency from backend
- Bump cache to ns-v20

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'ns-v19';
+const CACHE = 'ns-v20';
 const PRECACHE = ['/', 'index.html', 'styles.css', 'app.js', 'sw.js', 'manifest.json', 'icon.svg'];
 const SKIP_URLS = ['/rest/stream', '/rest/download', '/config.js'];