feat(server): expose desktop-downloads file route to TokenOrUserAuth

Add userRoute.GET /api/user/desktop-downloads/file/:platform with
TokenOrUserAuth middleware. A plain browser <a href> can hit this with
just the session cookie; New-Api-User header isn't required (the SPA's
axios layer still injects it for the metadata endpoint on selfRoute).

Closes the 401 "无权进行此操作，未提供 New-Api-User" case from the
Heicode Manager desktop installer download path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

heicode/router/api-router.go

@@ -68,6 +68,12 @@ func SetApiRouter(router *gin.Engine) {
 			userRoute.GET("/epay/notify", controller.EpayNotify)
 			userRoute.GET("/groups", controller.GetUserGroups)
 
+			// Heicode desktop installer file streaming — uses TokenOrUserAuth so a plain
+			// browser <a href> download (cookie only, no New-Api-User header) works.
+			// The metadata endpoint stays on selfRoute since the SPA's axios layer
+			// already injects the required header.
+			userRoute.GET("/desktop-downloads/file/:platform", middleware.TokenOrUserAuth(), controller.DownloadDesktopFile)
+
 			selfRoute := userRoute.Group("/")
 			selfRoute.Use(middleware.UserAuth())
 			{
@@ -77,9 +83,8 @@ func SetApiRouter(router *gin.Engine) {
 				selfRoute.PUT("/self", controller.UpdateSelf)
 				selfRoute.DELETE("/self", controller.DeleteSelf)
 				selfRoute.GET("/token", controller.GenerateAccessToken)
-				// Heicode desktop client installers (paths from env, login required)
+				// Heicode desktop client installers metadata (login required)
 				selfRoute.GET("/desktop-downloads", controller.GetDesktopDownloads)
-				selfRoute.GET("/desktop-downloads/file/:platform", controller.DownloadDesktopFile)
 
 				selfRoute.GET("/passkey", controller.PasskeyStatus)
 				selfRoute.POST("/passkey/register/begin", controller.PasskeyRegisterBegin)