fix(auth): honor disabled guest access - #162

…placeholders (OpenListTeam#113)

* fix(static): repair /manifest.json 401 on cookie-gated deployments (EdgeOne preview)

Three stacked issues made /manifest.json the only failing request:

1. Frontend OpenListTeam#162 (2025-08-08) repointed index.html from /static/manifest.json
   to /manifest.json to match the Go backend dynamic route
   (OpenList server/router.go:36), but the dist still only ships
   static/manifest.json - no root manifest.json exists.
2. The TS worker never aligned that route, so /manifest.json fell through to
   the SPA fallback (text/html on Cloudflare).
3. On cookie-gated platforms (EdgeOne Makers preview domains, eo_time), every
   other request carries the auth cookie while the PWA manifest fetch is made
   without any credentials by Chromium - so manifest.json alone got 401.

Fix:
- fetch-frontend.mjs: copy static/manifest.json -> manifest.json at build
  time (covers static-first platforms like EdgeOne Pages) and add
  crossorigin="use-credentials" to the manifest <link> so the browser sends
  cookies; both idempotent, applied to every dist source path.
- assets.ts: new ensureManifestCredentials() applied to all HTML served by
  getIndexHtmlWithCdn (covers CDN-sourced index.html, path B), plus a
  /manifest.json -> /static/manifest.json 302 route aligned with the Go
  router for worker-served traffic.
- assets.test.ts: 5 new cases for the attribute patch and the CDN path.

Verified: server suite 184/184, tsc --noEmit clean, fetch-frontend end-to-end
produces dist/manifest.json and a patched index.html.

* fix(edgeone): restore server-handler detection via committed handler placeholders

EdgeOne Pages decides whether a project has a Node backend by scanning the
repository content, not the post-build filesystem: with the handler artifact
gitignored (PR OpenListTeam#93), detection fails ("No server-handler detected, generating
routes.json for pure project") and /api/* falls into the static rewrites
returning index.html - while functions/kv-* keep working.

- scripts/build-edge.mjs: emit the bundled handler to the officially
  documented node-functions/[[default]].js in addition to the historical
  cloud-functions/[[default]].js; the deploy-time build overwrites both with
  the fresh ~2MB bundle, so runtime always executes the latest code.
- cloud-functions/[[default]].js + node-functions/[[default]].js: track a
  tiny, never-changing placeholder (valid onRequest export returning 503).
  It exists only so platform detection sees a server handler; the deploy
  build overwrites it with the real bundle on the build filesystem. Merge
  conflicts on artifacts are structurally impossible and contributors never
  need to touch these files. This supersedes both PR OpenListTeam#93's
  gitignored-artifact approach and an interim full-artifact-committed one.
- middleware.js: export config ({ matcher: [{ source: "/:path*" }] }) as the
  platform expects, silencing "Could not find config in middleware file,
  using defaults".
- .github/workflows/build-verify.yml: assert the tracked entries are still
  the placeholder so accidentally committing a full build fails CI with a
  clear message.
- .gitignore: stop ignoring the two handler entry files.

Verified on a live EdgeOne deployment: /api/public/settings returns JSON
again after deploying this change.

- 合并 upstream/main（139 驱动 token 修复、Wrangler bundler safer-buffer、WebDAV 播放 401、OpenListTeam#162 权限修复等）
- observability.enabled：免费版含 20 万事件/日、保留 3 天，此前线上为 None
- placement.mode=smart：Worker 实测在 LAX 执行，而网盘 origin 在国内
- 注：上游已移除 CACHE_* 环境变量（代码不再读取），故原计划的 CACHE_TTL 调整取消