Fix Blossom CORS headers and add root-level upload routes (v0.36.12)

- Add proper CORS headers for Blossom endpoints including X-SHA-256,
  X-Content-Length, X-Content-Type headers required by blossom-client-sdk
- Add root-level Blossom routes (/upload, /media, /mirror, /report, /list/)
  for clients like Jumble that expect Blossom at root
- Export BaseURLKey from pkg/blossom for use by app handlers
- Make blossomRootHandler return URLs with /blossom prefix so blob
  downloads work via the registered /blossom/ route
- Remove Access-Control-Allow-Credentials header (not needed for * origin)
- Add Access-Control-Expose-Headers for X-Reason and other response headers

Files modified:
- app/blossom.go: Add blossomRootHandler, use exported BaseURLKey
- app/server.go: Add CORS handling for blossom paths, register root routes
- pkg/blossom/server.go: Fix CORS headers, export BaseURLKey
- pkg/blossom/utils.go: Minor formatting
- pkg/version/version: Bump to v0.36.12

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/blossom.go

@@ -42,12 +42,23 @@ func (s *Server) blossomHandler(w http.ResponseWriter, r *http.Request) {
 	if !strings.HasPrefix(r.URL.Path, "/") {
 		r.URL.Path = "/" + r.URL.Path
 	}
-	
+
 	// Set baseURL in request context for blossom server to use
+	// Use the exported key type from the blossom package
 	baseURL := s.ServiceURL(r) + "/blossom"
-	type baseURLKey struct{}
-	r = r.WithContext(context.WithValue(r.Context(), baseURLKey{}, baseURL))
-	
+	r = r.WithContext(context.WithValue(r.Context(), blossom.BaseURLKey{}, baseURL))
+
+	s.blossomServer.Handler().ServeHTTP(w, r)
+}
+
+// blossomRootHandler handles blossom requests at root level (for clients like Jumble)
+// Note: Even though requests come to root-level paths like /upload, we return URLs
+// with /blossom prefix because that's where the blob download handlers are registered.
+func (s *Server) blossomRootHandler(w http.ResponseWriter, r *http.Request) {
+	// Set baseURL with /blossom prefix so returned blob URLs point to working handlers
+	baseURL := s.ServiceURL(r) + "/blossom"
+	r = r.WithContext(context.WithValue(r.Context(), blossom.BaseURLKey{}, baseURL))
+
 	s.blossomServer.Handler().ServeHTTP(w, r)
 }