fix: proxy audio stream through API with query-param token auth

WaveSurfer makes plain browser fetches without Authorization headers,
causing 401s on the stream endpoint. The stream endpoint now accepts
a ?token= query param in addition to the Authorization header, and
proxies audio bytes directly through FastAPI instead of redirecting to
raw WebDAV (which would require a second Nextcloud auth challenge).
Falls back to nc_file_path if HLS transcoding hasn't run yet.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/src/hooks/useWaveform.ts

@@ -31,7 +31,9 @@ export function useWaveform(
       normalize: true,
     });
 
-    ws.load(options.url);
+    const token = localStorage.getItem("rh_token");
+    const audioUrl = token ? `${options.url}?token=${encodeURIComponent(token)}` : options.url;
+    ws.load(audioUrl);
 
     ws.on("ready", () => {
       setIsReady(true);