fix(tauri): bypass WebView CORS for packaged R2/S3 apps

Preserve aws4fetch Request headers in the shell fetch interceptor, and
proxy cross-origin HTTP through a native reqwest command so Windows/Android
builds work even when remote CORS only allows web origins.

template/src-tauri/capabilities/default.json

@@ -3,5 +3,5 @@
   "identifier": "default",
   "description": "Default capability for the main window",
   "windows": ["main"],
-  "permissions": ["core:default"]
+  "permissions": ["core:default", "allow-proxy-fetch"]
 }