音频改走无扩展名的 /media 路由：IDM / 迅雷 这类下载管理器不再弹「下载文件信息」

玩家那边遇到的是：游戏放着 BGM，突然弹出下载管理器的「下载文件信息」框，有时还会把整条
音轨抢去下载。原因是这些工具会嗅探以媒体扩展名结尾的 XHR/fetch。改成客户端统一请求不带
扩展名的 `/media/<原路径去掉 .mp3>`，服务端再解析回 `public/assets/audio/…`。

- `public/js/media.js`：`mediaUrl()` 把 `/assets/audio/**.mp3` 换算成 `/media/**`，只处理同源、
  且扩展名在名单内的地址；跨域、目录、`..`、点开头、不认识的扩展名一律原样返回。
- `server/index.js`：新增 `/media/` 路由。按 `AUDIO_EXTS` 顺序找 `.mp3/.m4a/.aac/.ogg/.oga/.opus/.wav`，
  显式写了扩展名的以它为准；Range/ETag/Content-Type/缓存策略都复用 `serveFile`，所以和直接请求
  `/assets/audio/…` 行为一致（一天缓存、支持 Range）。
- 直接请求 `/assets/audio/…` 仍然可用 —— 这是给不支持 `/media/` 的纯静态托管留的退路，客户端
  在 `/media/` 404 时才回退到原地址。

安全：`/media/` 的路径只接受正常片段，`..`/`.` 直接 403，点开头或点结尾的片段 404，解析出的
绝对路径必须落在 `public/assets/audio` 之内，且只允许上面那几个音频扩展名 —— 不会变成任意文件读取。

测试：
- `test/media-url.test.js`：`mediaUrl()` 的换算与各种「别动它」的边界。
- `test/lobby.test.js`：真实服务器上的 `/media` 路由（正常解析、显式扩展名优先、Range、HEAD、
  目录与穿越请求被拒、客户端回退用到的 `/media/bgm.mp3` 仍 200）。
- `test/ui/audio.test.js`：音频管理器现在先请求无扩展名地址，404 才回退原地址；断言跟着
  `mediaUrl()` 换算后再比对（原先拿 manifest 原地址比对，等于断言一个客户端永不请求的 URL）。

server/index.js

@@ -311,6 +311,11 @@ export function createStaticHandler({ publicDir, dataDir, sharedDir, simDir = pa
       res.end(req.method === 'HEAD' ? undefined : shimBody);
       return;
     }
+    // Extension-less audio (download-manager avoidance): /media/bgm/act1 → /assets/audio/bgm/act1.mp3
+    if (decoded.startsWith(MEDIA_PREFIX)) {
+      await serveMedia(req, res, decoded.slice(MEDIA_PREFIX.length), query, publicDir, gzipCache, log);
+      return;
+    }
     // Bare mount paths (e.g. "/data") → treat as the mount directory.
     const mount = mounts.find((m) => decoded.startsWith(m.prefix) || decoded === m.prefix.slice(0, -1)) || mounts[mounts.length - 1];
     const rest = decoded.length > mount.prefix.length ? decoded.slice(mount.prefix.length) : '';
@@ -372,6 +377,53 @@ export function createStaticHandler({ publicDir, dataDir, sharedDir, simDir = pa
   };
 }
 
+/**
+ * Extension-less audio route: `/media/bgm/act1` → `public/assets/audio/bgm/act1.mp3`.
+ *
+ * Clients ask for audio through this path because download managers (IDM, 迅雷, FDM …) hijack XHR/fetch whose
+ * URL ends in a media extension and pop a "下载文件信息" dialog for every BGM track — see `public/js/media.js`.
+ * Requests for the direct `/assets/audio/…` URLs keep working (they are the fallback for plain static hosts).
+ */
+const MEDIA_PREFIX = '/media/';
+/** Extensions a `/media/…` request may resolve to, in order. */
+export const AUDIO_EXTS = Object.freeze(['.mp3', '.m4a', '.aac', '.ogg', '.oga', '.opus', '.wav']);
+
+async function serveMedia(req, res, rest, query, publicDir, gzipCache, log) {
+  const root = path.join(path.resolve(publicDir), 'assets', 'audio');
+  const segments = String(rest || '').split('/').filter((s) => s.length > 0);
+  if (!segments.length || rest.endsWith('/')) { sendError(req, res, 404, '页面不存在 · Not found'); return; }
+  if (segments.some((s) => s === '..' || s === '.')) { sendError(req, res, 403, '禁止访问 · Forbidden'); return; }
+  // A leading or trailing dot would address something else (dotfiles, "x..mp3") — and the client never asks for it.
+  if (segments.some((s) => s.startsWith('.') || s.endsWith('.'))) { sendError(req, res, 404, '页面不存在 · Not found'); return; }
+
+  const last = segments[segments.length - 1];
+  const given = path.extname(last).toLowerCase();
+  const wanted = AUDIO_EXTS.includes(given) ? given : '';
+  const stem = wanted ? last.slice(0, -wanted.length) : last;
+  if (!stem || stem.startsWith('.')) { sendError(req, res, 404, '页面不存在 · Not found'); return; }
+  const dir = path.join(root, ...segments.slice(0, -1));
+  if (dir !== root && !dir.startsWith(root + path.sep)) { sendError(req, res, 403, '禁止访问 · Forbidden'); return; }
+
+  // An explicit extension wins (`/media/bgm.ogg` → bgm.ogg), otherwise the usual order decides.
+  const order = wanted ? [wanted, ...AUDIO_EXTS.filter((e) => e !== wanted)] : AUDIO_EXTS;
+  for (const ext of order) {
+    const absPath = path.join(dir, stem + ext);
+    if (!absPath.startsWith(root + path.sep)) continue;
+    let stat;
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      stat = await fsp.stat(absPath);
+    } catch { continue; }
+    if (!stat.isFile()) continue;
+    // serveFile decides Content-Type from the resolved name (`.mp3` → audio/mpeg) — Range/ETag handling is shared.
+    // Cache policy is that of the public path the client would otherwise have asked for (`/assets/audio/…`, 1 day).
+    // eslint-disable-next-line no-await-in-loop
+    await serveFile(req, res, absPath, stat, 'public', ['assets', 'audio', ...segments], query, gzipCache, log);
+    return;
+  }
+  sendError(req, res, 404, '页面不存在 · Not found');
+}
+
 async function serveFile(req, res, absPath, stat, mountName, segments, query, gzipCache, log) {
   const ext = path.extname(absPath).toLowerCase();
   const type = MIME[ext] || 'application/octet-stream';