fix(tauri): bypass WebView CORS for packaged R2/S3 apps

Preserve aws4fetch Request headers in the shell fetch interceptor, and
proxy cross-origin HTTP through a native reqwest command so Windows/Android
builds work even when remote CORS only allows web origins.

template/src-tauri/permissions/proxy-fetch.toml

@@ -0,0 +1,4 @@
+[[permission]]
+identifier = "allow-proxy-fetch"
+description = "Allow the app webview to perform native HTTP requests (CORS bypass for packaged sites)."
+commands.allow = ["proxy_fetch"]