fix: video/audio streaming instead of blob download

Videos and audio now stream directly via URL with auth token query
param instead of downloading entire file into a JS blob. Fixes
playback of large videos (170MB+ was timing out). Images still use
blob URLs. streamUrl() added to filebrowser client and cloud store.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/api/filebrowser-client.ts

@@ -122,6 +122,7 @@ class FileBrowserClient {
   /**
    * Fetch a file as a blob URL using header-based auth (no token in URL).
    * Use this for img/video/audio src attributes and download links.
+   * For large files (video/audio), prefer streamUrl() instead.
    */
   async fetchBlobUrl(path: string): Promise<string> {
     await this.ensureAuth()
@@ -134,6 +135,18 @@ class FileBrowserClient {
     return URL.createObjectURL(blob)
   }
 
+  /**
+   * Get a direct streaming URL with auth token in query string.
+   * Use for video/audio <src> where browser needs to stream (range requests).
+   * The token is a short-lived JWT so exposure in URL is acceptable.
+   */
+  async streamUrl(path: string): Promise<string> {
+    await this.ensureAuth()
+    const token = this.getAuthCookie()
+    const safePath = sanitizePath(path)
+    return `${this.baseUrl}/api/raw${safePath}?auth=${token}`
+  }
+
   /**
    * Trigger a file download using header-based auth (no token in URL).
    */