Stop browsers from caching songs

/music/rand and the other song endpoints return a different song from the
same URL, but the responses had a Last-Modified header and no Cache-Control,
so browsers cached them. The same song played again and the server never
picked a new one, so /music/addQue added nothing. Send Cache-Control:
no-store again, as the server did before the rewrite.

Also allow the Cache-Control request header in CORS, which the frontend
sends to bypass responses that browsers have already cached.

internal/server/routes.go

@@ -46,7 +46,7 @@ func (s *Server) routes() (*echo.Echo, huma.API) {
 		e.Use(echoMiddleware.CORSWithConfig(echoMiddleware.CORSConfig{
 			AllowOrigins:  s.cfg.CORSAllowedOrigins,
 			AllowMethods:  []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"},
-			AllowHeaders:  []string{"Accept", "Authorization", "Content-Type", "Range", middleware.QueueHeader},
+			AllowHeaders:  []string{"Accept", "Authorization", "Cache-Control", "Content-Type", "Range", middleware.QueueHeader},
 			ExposeHeaders: []string{middleware.QueueHeader, "Content-Range", "Accept-Ranges"},
 			MaxAge:        300,
 		}))