[bugfix] add mode: no-cors to fix CORS error when following GCS redirects

When the service worker re-fetches with redirect: 'follow', it follows
the redirect to GCS, which doesn't have CORS headers.

Adding mode: 'no-cors':
- Allows cross-origin fetches without CORS headers
- Returns opaque response (works fine for images/videos/audio)
- Prevents CORS error when loading from GCS

public/auth-sw.js

@@ -67,15 +67,29 @@ self.addEventListener('fetch', (event) => {
           })
         )
 
-        // If redirected to external storage (GCS), follow without auth headers
-        // The signed URL contains its own authentication in query params
-        if (
-          response.type === 'opaqueredirect' ||
-          response.status === 302 ||
-          response.status === 301
-        ) {
+        // Handle redirects to external storage (e.g., GCS signed URLs)
+        if (response.type === 'opaqueredirect') {
+          // Opaqueredirect: redirect occurred but response is opaque (headers not accessible)
+          // Re-fetch the original /api/view URL with redirect: 'follow' and mode: 'no-cors'
+          // - mode: 'no-cors' allows cross-origin fetches without CORS headers (GCS doesn't have CORS)
+          // - Returns opaque response, which works fine for images/videos/audio
+          // - Browser will send auth headers to /api/view (same-origin)
+          // - Browser will receive 302 redirect to GCS
+          // - Browser will follow redirect using GCS signed URL authentication
+          return fetch(event.request.url, {
+            method: 'GET',
+            headers: headers,
+            redirect: 'follow',
+            mode: 'no-cors'
+          })
+        }
+
+        // Non-opaque redirect (status visible) - shouldn't normally happen with redirect: 'manual'
+        // but handle as fallback
+        if (response.status === 302 || response.status === 301) {
           const location = response.headers.get('location')
           if (location) {
+            // Follow redirect manually - do NOT include auth headers for external URLs
             return fetch(location, {
               method: 'GET',
               redirect: 'follow'

src/main.ts

@@ -83,8 +83,9 @@ app
   })
 
 // Register auth service worker after Pinia is initialized (cloud-only)
+// Wait for registration to complete before mounting to ensure SW controls the page
 if (isCloud) {
-  void import('@/platform/auth/serviceWorker')
+  await import('@/platform/auth/serviceWorker')
 }
 
 app.mount('#vue-app')

src/platform/auth/serviceWorker/index.ts

@@ -5,5 +5,5 @@ import { isCloud } from '@/platform/distribution/types'
  * Tree-shaken for desktop/localhost builds via compile-time constant.
  */
 if (isCloud) {
-  void import('./register')
+  await import('./register')
 }

src/platform/auth/serviceWorker/register.ts

@@ -54,4 +54,4 @@ function setupCacheInvalidation(): void {
   })
 }
 
-void registerAuthServiceWorker()
+await registerAuthServiceWorker()