a gzipped response was handed on still labelled gzipped

`fetch` decompresses a response body before anyone sees it, and the headers it
returns still say `content-encoding: gzip`. Copying those onto the decoded bytes
tells the client to gunzip plain JSON: `Decompression error: ZlibError`, which
surfaced as a 502 from the catch that wraps the forward.

It hides well, and that is the part worth writing down. A 401 body is a few bytes
and is not compressed, so every unauthenticated probe passes. The first request
carrying a real credential is the first one big enough to be gzipped, and the
first one to fail - which reads as "the credential broke it".

Measured on alpha in exactly that order: the extension door answered 401 without
a token and 502 with one.

`content-length` goes too. It describes the compressed length and the body being
handed on is not that length.

Response headers are now a different function from request headers, because they
are a different question and treating them as one is what caused this.

api/router.ts

@@ -1,7 +1,7 @@
 import { createRouter } from '@@/create-router';
 import { createSidecarProxy } from '@@/sidecar/create-proxy';
 import { getLinkwardenConfig, setLinkwardenConfig, getAccount } from '../db/queries';
-import { stripHopByHop } from '../sidecar/upstream';
+import { stripHopByHop, stripResponseHeaders } from '../sidecar/upstream';
 
 /**
  * Mounted at `/api/linkwarden`.
@@ -73,7 +73,7 @@ router.all('/lw/*', async (ctx) => {
 
   try {
     const upstream = await fetch(`${base}${subpath}${url.search}`, init);
-    return new Response(upstream.body, { status: upstream.status, headers: stripHopByHop(upstream.headers) });
+    return new Response(upstream.body, { status: upstream.status, headers: stripResponseHeaders(upstream.headers) });
   } catch {
     return ctx.text('Linkwarden unreachable', 502);
   }
@@ -174,7 +174,7 @@ router.all('/api/*', async (ctx) => {
 
   try {
     const upstream = await fetch(`${base}${subpath}${url.search}`, init);
-    return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
+    return new Response(upstream.body, { status: upstream.status, headers: stripResponseHeaders(upstream.headers) });
   } catch {
     return ctx.json({ error: 'Linkwarden unreachable' }, 502);
   }