Fix Blossom CORS headers and add root-level upload routes (v0.36.12)

- Add proper CORS headers for Blossom endpoints including X-SHA-256,
  X-Content-Length, X-Content-Type headers required by blossom-client-sdk
- Add root-level Blossom routes (/upload, /media, /mirror, /report, /list/)
  for clients like Jumble that expect Blossom at root
- Export BaseURLKey from pkg/blossom for use by app handlers
- Make blossomRootHandler return URLs with /blossom prefix so blob
  downloads work via the registered /blossom/ route
- Remove Access-Control-Allow-Credentials header (not needed for * origin)
- Add Access-Control-Expose-Headers for X-Reason and other response headers

Files modified:
- app/blossom.go: Add blossomRootHandler, use exported BaseURLKey
- app/server.go: Add CORS handling for blossom paths, register root routes
- pkg/blossom/server.go: Fix CORS headers, export BaseURLKey
- pkg/blossom/utils.go: Minor formatting
- pkg/version/version: Bump to v0.36.12

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

pkg/blossom/server.go

@@ -141,10 +141,12 @@ func (s *Server) Handler() http.Handler {
 // setCORSHeaders sets CORS headers as required by BUD-01
 func (s *Server) setCORSHeaders(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Access-Control-Allow-Origin", "*")
-	w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, PUT, DELETE")
-	w.Header().Set("Access-Control-Allow-Headers", "Authorization, *")
+	w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, PUT, DELETE, OPTIONS")
+	// Include all headers used by Blossom clients (BUD-01, BUD-06)
+	// Include both cases for maximum compatibility with various clients
+	w.Header().Set("Access-Control-Allow-Headers", "Authorization, authorization, Content-Type, content-type, X-SHA-256, x-sha-256, X-Content-Length, x-content-length, X-Content-Type, x-content-type, Accept, accept")
+	w.Header().Set("Access-Control-Expose-Headers", "X-Reason, Content-Length, Content-Type, Accept-Ranges")
 	w.Header().Set("Access-Control-Max-Age", "86400")
-	w.Header().Set("Access-Control-Allow-Credentials", "true")
 	w.Header().Set("Vary", "Origin, Access-Control-Request-Method, Access-Control-Request-Headers")
 }
 
@@ -198,10 +200,12 @@ func (s *Server) checkACL(
 	return actual >= required
 }
 
+// BaseURLKey is the context key for the base URL (exported for use by app handler)
+type BaseURLKey struct{}
+
 // getBaseURL returns the base URL, preferring request context if available
 func (s *Server) getBaseURL(r *http.Request) string {
-	type baseURLKey struct{}
-	if baseURL := r.Context().Value(baseURLKey{}); baseURL != nil {
+	if baseURL := r.Context().Value(BaseURLKey{}); baseURL != nil {
 		if url, ok := baseURL.(string); ok && url != "" {
 			return url
 		}