feat(node-player): use Service Worker for auth, enable streaming playback

Add a Service Worker that intercepts /api/* requests and injects the
Bearer token. This allows <audio> and <img> elements to use direct
URLs instead of downloading entire files as blobs first.

- Audio now streams progressively (no full download before playback)
- Cover art loads via regular <img src> (SW adds auth header)
- Remove blob-based preloadStream, fetchCoverBlob, useCoverUrl hook
- Register SW in main.tsx, token synced via postMessage

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

furumi-node-player/client/public/sw.js

@@ -0,0 +1,23 @@
+let bearerToken = null
+
+self.addEventListener('message', (e) => {
+  if (e.data?.type === 'SET_TOKEN') {
+    bearerToken = e.data.token
+  }
+})
+
+self.addEventListener('fetch', (e) => {
+  const url = new URL(e.request.url)
+  // Only intercept /api/ requests to the same origin
+  if (url.origin !== self.location.origin || !url.pathname.startsWith('/api/')) return
+  if (!bearerToken) return
+
+  const authedRequest = new Request(e.request, {
+    headers: new Headers(e.request.headers),
+  })
+  authedRequest.headers.set('Authorization', `Bearer ${bearerToken}`)
+  e.respondWith(fetch(authedRequest))
+})
+
+self.addEventListener('install', () => self.skipWaiting())
+self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()))