feat: swipe-up player bar opens Now Playing; fix backend CORS for reverse proxy

- Add touchstart/touchend on .player bar: swipe up ≥40px or fast flick opens np-overlay
- Replace cors() package with explicit middleware that sets Access-Control-Allow-Origin/Methods/Headers and Access-Control-Allow-Private-Network (needed for Chrome when backend is on private network or behind proxy)
- Remove cors npm dependency from backend
- Bump cache to ns-v20

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.js

@@ -125,6 +125,22 @@ window.addEventListener('load',()=>{
   // Now Playing: click player-art to open
   const pa=document.getElementById('player-art');
   if(pa)pa.addEventListener('click', openNowPlaying);
+  // Swipe-up on player bar to open Now Playing
+  const playerBar=document.querySelector('.player');
+  if(playerBar){
+    let _sy=0,_st=0;
+    playerBar.addEventListener('touchstart',e=>{
+      if(e.target.closest('button')||e.target.closest('.progress-bar')||e.target.closest('.volume-wrap'))return;
+      _sy=e.touches[0].clientY;_st=Date.now();
+    },{passive:true});
+    playerBar.addEventListener('touchend',e=>{
+      if(!_sy)return;
+      const dy=_sy-e.changedTouches[0].clientY;
+      const dt=Date.now()-_st;
+      if(dy>40||(dt<300&&dy>15))openNowPlaying();
+      _sy=0;
+    },{passive:true});
+  }
 });
 
 async function startApp(){

backend/novasonic-server.js

@@ -15,7 +15,6 @@
  */
 
 const express = require('express');
-const cors    = require('cors');
 const { spawn, execSync } = require('child_process');
 const path    = require('path');
 const fs      = require('fs');
@@ -33,7 +32,14 @@ const CONFIG = {
 
 // ─── INIT ─────────────────────────────────────────────────────────────────────
 const app = express();
-app.use(cors());
+app.use((req,res,next)=>{
+  res.setHeader('Access-Control-Allow-Origin','*');
+  res.setHeader('Access-Control-Allow-Methods','GET,POST,OPTIONS');
+  res.setHeader('Access-Control-Allow-Headers','Content-Type,Authorization');
+  res.setHeader('Access-Control-Allow-Private-Network','true');
+  if(req.method==='OPTIONS'){res.sendStatus(204);return;}
+  next();
+});
 app.use(express.json());
 
 // In-memory job store

sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'ns-v19';
+const CACHE = 'ns-v20';
 const PRECACHE = ['/', 'index.html', 'styles.css', 'app.js', 'sw.js', 'manifest.json', 'icon.svg'];
 const SKIP_URLS = ['/rest/stream', '/rest/download', '/config.js'];