Stop browsers from caching songs

/music/rand and the other song endpoints return a different song from the
same URL, but the responses had a Last-Modified header and no Cache-Control,
so browsers cached them. The same song played again and the server never
picked a new one, so /music/addQue added nothing. Send Cache-Control:
no-store again, as the server did before the rewrite.

Also allow the Cache-Control request header in CORS, which the frontend
sends to bypass responses that browsers have already cached.

internal/server/files.go

@@ -52,9 +52,21 @@ func streamOpenFile(f *os.File, contentType string, audio bool) (*huma.StreamRes
 }
 
 // streamSong streams the song at path, or returns err mapped to an API error.
+// The same URL returns a different song each time (random songs, next, previous),
+// so browsers must not cache it. Without this they cache the response because of
+// its Last-Modified header, and play the same song again.
 func streamSong(path string, err error) (*huma.StreamResponse, error) {
 	if err != nil {
 		return nil, apiError(err)
 	}
-	return streamFile(path, "audio/mpeg", true)
+	resp, err := streamFile(path, "audio/mpeg", true)
+	if err != nil {
+		return nil, err
+	}
+	body := resp.Body
+	resp.Body = func(ctx huma.Context) {
+		ctx.SetHeader("Cache-Control", "no-store")
+		body(ctx)
+	}
+	return resp, nil
 }