按 review 意见：/media/ 的路径与扩展名列表提到 shared/ 共用

- server/index.js 开头的路由说明补上 /media/
- AUDIO_EXTS 原先客户端（public/js/media.js）与服务端各一份，只改一边就会悄悄漂移：
  现在两边都从 shared/media.js 取；服务端那份不再 export
- isMediaUrl 只有测试在用，删掉（新增 shared/media.js，测试改从那里取前缀/扩展名）
- 顺手做了 review 里「可选」的那点：有些静态托管对不存在的路径回 200 + index.html，
  这种响应解码会静默失败，所以除了 404，声明了非 audio/* 类型的响应也回退到原地址
  （完全没声明 content-type 的不算错——没有证据表明它不是音频）

server/index.js

@@ -8,6 +8,9 @@
 //                                /data.js → a generated browser stand-in of server/data.js (the sim's content modules
 //                                           import `../../../data.js`; in the browser it serves the data injected with
 //                                           /sim/simdata.js setSimData). No other server file is ever served.
+//                                /media/bgm/act1 → public/assets/audio/bgm/act1.mp3 — the same audio files, addressed
+//                                           **without** an extension so download managers (IDM / 迅雷 …) stop popping a
+//                                           "下载文件信息" dialog for every BGM track (shared/media.js, public/js/media.js)
 //     MIME types incl. .mjs/.js text/javascript, .skel application/octet-stream, .atlas text/plain;
 //     gzip for text-like types, .skel and uncompressed fonts when the client accepts it (small files are
 //     compressed once and cached in memory); strong ETag + Last-Modified with 304s; Cache-Control
@@ -39,6 +42,7 @@ import { Network, SessionRegistry, NET_DEFAULTS } from './net.js';
 import { Lobby } from './lobby.js';
 import { getData, loadData } from './data.js';
 import { PROTOCOL_VERSION, APP_VERSION } from '../shared/constants.js';
+import { MEDIA_PREFIX, AUDIO_EXTS } from '../shared/media.js';
 
 /** Repository root. */
 export const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -383,11 +387,9 @@ export function createStaticHandler({ publicDir, dataDir, sharedDir, simDir = pa
  * Clients ask for audio through this path because download managers (IDM, 迅雷, FDM …) hijack XHR/fetch whose
  * URL ends in a media extension and pop a "下载文件信息" dialog for every BGM track — see `public/js/media.js`.
  * Requests for the direct `/assets/audio/…` URLs keep working (they are the fallback for plain static hosts).
+ * `MEDIA_PREFIX` / `AUDIO_EXTS` live in `shared/media.js`: the browser decides which URLs to rewrite with the
+ * same two values, and they must not drift apart.
  */
-const MEDIA_PREFIX = '/media/';
-/** Extensions a `/media/…` request may resolve to, in order. */
-export const AUDIO_EXTS = Object.freeze(['.mp3', '.m4a', '.aac', '.ogg', '.oga', '.opus', '.wav']);
-
 async function serveMedia(req, res, rest, query, publicDir, gzipCache, log) {
   const root = path.join(path.resolve(publicDir), 'assets', 'audio');
   const segments = String(rest || '').split('/').filter((s) => s.length > 0);