Fix PDF viewing: cookie auth fallback + .mjs MIME type

- /file and /pdf endpoints: make token optional, fall back to hnf_session
  cookie auth when no valid JWT token provided. Kitchen frontend passes the
  literal '__session__' compat shim so token-only auth always 401'd.
- Add Request injection so cookie-based fallback path can read hnf_session.
- nginx: add types block mapping .mjs → text/javascript so pdf.worker.min.mjs
  passes browser strict MIME check for ES module scripts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/nginx.conf

@@ -1,3 +1,8 @@
+types {
+  text/javascript  js mjs;
+  application/pdf  pdf;
+}
+
 server {
   listen 80;
   server_name _;