fix(tauri): bypass WebView CORS for packaged R2/S3 apps

Preserve aws4fetch Request headers in the shell fetch interceptor, and
proxy cross-origin HTTP through a native reqwest command so Windows/Android
builds work even when remote CORS only allows web origins.

template/src-tauri/gen/schemas/windows-schema.json

@@ -176,6 +176,12 @@
     "Identifier": {
       "description": "Permission identifier",
       "oneOf": [
+        {
+          "description": "Allow the app webview to perform native HTTP requests (CORS bypass for packaged sites).",
+          "type": "string",
+          "const": "allow-proxy-fetch",
+          "markdownDescription": "Allow the app webview to perform native HTTP requests (CORS bypass for packaged sites)."
+        },
         {
           "description": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`",
           "type": "string",