fix(upload): attach CORS guidance to direct upload failures

A new user's top first-upload failure is a missing R2 CORS policy (browser
PUT/POST blocked) -- and object-scoped R2 tokens often cannot auto-set CORS.
The connection test already surfaces buildCorsGuidance on the opaque
"Failed to fetch", but a user who skips the test and uploads directly got a
bare "Upload failed: Failed to fetch". The upload error handler now detects the
browser CORS/network rejection (isLikelyCorsError -- Chrome "Failed to fetch",
Firefox "NetworkError", Safari "Load failed") and appends the same actionable
guidance. Updated the R2 follow-up TODO (credential audit done; CORS reviewed).

Test: tests/services/r2-cors-error-classifier.test.mjs. Full suite green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/services/r2-cors-error-classifier.test.mjs

@@ -0,0 +1,28 @@
+// Scenario (SCN-cors-error-classifier):
+//   A browser CORS rejection during upload surfaces as an opaque network error
+//   with no HTTP status. isLikelyCorsError() must recognize the messages the
+//   major browsers actually produce (so the upload path can attach CORS guidance
+//   instead of a bare "Failed to fetch"), without false-positiving on ordinary
+//   errors (so we don't wrongly tell users to fix CORS).
+
+import "../test-helpers/setup-localstorage.mjs";
+import test from "node:test";
+import assert from "node:assert/strict";
+
+globalThis.__BITVID_DISABLE_NETWORK_IMPORTS__ = true;
+const { isLikelyCorsError } = await import("../../js/services/r2Service.js");
+
+test("recognizes the browsers' CORS/network rejection messages", () => {
+  assert.equal(isLikelyCorsError(new TypeError("Failed to fetch")), true); // Chrome
+  assert.equal(isLikelyCorsError(new Error("NetworkError when attempting to fetch resource.")), true); // Firefox
+  assert.equal(isLikelyCorsError(new TypeError("Load failed")), true); // Safari
+});
+
+test("does NOT false-positive on ordinary upload errors", () => {
+  assert.equal(isLikelyCorsError(new Error("Access Denied")), false);
+  assert.equal(isLikelyCorsError(new Error("File is empty (0 bytes).")), false);
+  assert.equal(isLikelyCorsError(new Error("NoSuchBucket")), false);
+  assert.equal(isLikelyCorsError(null), false);
+  assert.equal(isLikelyCorsError(undefined), false);
+  assert.equal(isLikelyCorsError({}), false);
+});