refactor(server): extract helpers and simplify auth dispatch

- Move `sha256_hex` and cookie constants to module level; drop `token_is_hash` param in favour of regex auto-detection
- Make `_respond()` accept `status`/`headers`; add `_redirect()` helper to eliminate boilerplate in auth routes
- Simplify `_dispatch()` with a `PUBLIC_ROUTES` set and positive-logic early-return
- Restrict CORS header to file API; auth responses no longer send `Access-Control-Allow-Origin: *`
- Extract `clearPager()` in frontend and deduplicate `copyText` fallback path

static/index.html

@@ -311,12 +311,11 @@ function fallbackCopy(text) {
 
 function copyText(text, msg) {
   msg = msg || t().copied;
+  const fallback = () => toast(fallbackCopy(text) ? msg : t().copyFail);
   if (navigator.clipboard?.writeText) {
-    navigator.clipboard.writeText(text)
-      .then(() => toast(msg))
-      .catch(() => { fallbackCopy(text) ? toast(msg) : toast(t().copyFail) });
+    navigator.clipboard.writeText(text).then(() => toast(msg)).catch(fallback);
   } else {
-    fallbackCopy(text) ? toast(msg) : toast(t().copyFail);
+    fallback();
   }
 }
 
@@ -416,12 +415,14 @@ function setPage(p) {
   renderFiles();
 }
 
+function clearPager() { $('pager').innerHTML = ''; $('per-page').innerHTML = '' }
+
 function renderPager(total) {
   const pages = Math.ceil(total / perPage);
   const pager = $('pager');
   const pp = $('per-page');
 
-  if (pages <= 1 && total <= PER_PAGE_OPTS[0]) { pager.innerHTML = ''; pp.innerHTML = ''; return }
+  if (pages <= 1 && total <= PER_PAGE_OPTS[0]) { clearPager(); return }
 
   /* per-page selector */
   pp.innerHTML = '<span class="lbl">' + t().perPage + '</span>' +
@@ -454,8 +455,7 @@ function renderPager(total) {
 function renderFiles() {
   if (!allFiles.length) {
     flist.innerHTML = '<div class="empty">' + t().empty + '</div>';
-    $('pager').innerHTML = '';
-    $('per-page').innerHTML = '';
+    clearPager();
     return;
   }
   const pages = Math.ceil(allFiles.length / perPage);