Fix CORS headers for static assets (WASM/JS files)

Add CORS headers to static assets location block. In nginx, add_header
in a location block replaces all parent add_header directives, so the
CORS headers need to be repeated in the location block that handles
.wasm and .js files.

This fixes the issue where threaded WASM files couldn't load because
they didn't have the required Cross-Origin headers.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

htlm/nginx.conf

@@ -37,5 +37,8 @@ server {
     location ~* \.(png|jpg|jpeg|gif|ico|wasm|js|css)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
+        # CORS headers must be repeated here because add_header in location block overrides parent
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
     }
 }