fix(server): allow x-opencode-directory-encoding header in CORS (#1825)

PR #1673 added sanitizeHeadersForBrowser in the fetch bridge to handle
non-ISO-8859-1 directory paths by encoding the value and attaching a
x-opencode-directory-encoding: uri header. The server-side decoder was
already in place (08b86613). However, the CORS Access-Control-Allow-Headers
list on the Express server was not updated to include this new header.

When a user opens a directory with CJK or other non-Latin-1 characters
(e.g. D:\文件), the browser sends a CORS preflight OPTIONS request with
x-opencode-directory-encoding in the Access-Control-Request-Headers.
The preflight fails because the server does not list it as allowed,
blocking all subsequent API requests with 'Failed to fetch'.

Add X-OpenCode-Directory-Encoding to the Access-Control-Allow-Headers
response header for openchamber-ui://app packaged client origin.

packages/web/server/index.js

@@ -1183,7 +1183,7 @@ async function main(options = {}) {
       res.setHeader('Access-Control-Allow-Origin', origin);
       res.setHeader('Access-Control-Allow-Credentials', 'true');
       res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
-      res.setHeader('Access-Control-Allow-Headers', 'Content-Type,Authorization,Accept,X-Requested-With,Cache-Control,X-OpenCode-Directory');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type,Authorization,Accept,X-Requested-With,Cache-Control,X-OpenCode-Directory,X-OpenCode-Directory-Encoding');
       res.setHeader('Access-Control-Expose-Headers', 'x-next-cursor');
       res.setHeader('Vary', 'Origin');
       if (req.method === 'OPTIONS') {