Serve hashed assets from R2 via CDN_BASE (#3773)

## Description:

Add an optional CDN_BASE env var that prefixes hashed asset URLs from
asset-manifest.json, so the app can serve static assets from R2/CDN
instead of the app origin. The value is determined at runtime via the
EJS template (window.CDN_BASE) — empty string means "same origin,"
matching today's behavior.

A hack to load the worker bundle:

A same-origin Blob script that dynamic-import()s the cross-origin worker
module and buffers early postMessage calls until the imported module's
handler attaches, sidestepping the browser's refusal to construct a
Worker directly from a cross-origin URL.

## Please complete the following:

- [x] I have added screenshots for all UI updates
- [x] I process any text displayed to the user through translateText()
and I've added it to the en.json file
- [x] I have added relevant tests to the test directory
- [x] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced

## Please put your Discord username so you can be contacted if a bug or
regression is found:

evan

example.env

@@ -11,6 +11,11 @@ DOMAIN=your-domain.com
 # API Key
 API_KEY=your_api_key_here
 
+# Optional CDN origin (e.g. https://cdn.example.com) prepended to hashed asset
+# URLs from asset-manifest.json. Leave empty to serve assets from the same
+# origin as the app. No trailing slash.
+CDN_BASE=
+
 # Server Hosts
 SERVER_HOST_STAGING=123.456.78.90
 SERVER_HOST_NBG1=123.456.78.92