- Move `sha256_hex` and cookie constants to module level; drop `token_is_hash` param in favour of regex auto-detection
- Make `_respond()` accept `status`/`headers`; add `_redirect()` helper to eliminate boilerplate in auth routes
- Simplify `_dispatch()` with a `PUBLIC_ROUTES` set and positive-logic early-return
- Restrict CORS header to file API; auth responses no longer send `Access-Control-Allow-Origin: *`
- Extract `clearPager()` in frontend and deduplicate `copyText` fallback path
- get_local_ip: use context manager to prevent socket leak
- _route_files: single stat() per file instead of two
- _safe_path helper: DRY path resolution for download/delete
- load_config: loop over vars(args) instead of 6 repetitive blocks
- Remove stale comment from index.html
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Server-side _file_type() now uses mimetypes for images/known text,
and falls back to null-byte check on first 8KB for everything else.
Client uses the "type" field from /files API instead of local extension sets.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
eberkheev
