chenchenandClaude Opus 4.7
2f75588ed1
Add userRoute.GET /api/user/desktop-downloads/file/:platform with TokenOrUserAuth middleware. A plain browser <a href> can hit this with just the session cookie; New-Api-User header isn't required (the SPA's axios layer still injects it for the metadata endpoint on selfRoute). Closes the 401 "无权进行此操作，未提供 New-Api-User" case from the Heicode Manager desktop installer download path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>