fix: Wrong Windows MIME types in regedit will cause browser to refuse execute the renderer bundle

[i-so-late]

What and why

在render/server.py 中，Windows会从注册表中读取mimetypes。假如注册表中的.js值被某些软件错误改为了text/plain，那么bundle中的所有.js都会被解析为text/plain，而nosniff设置会导致浏览器拒绝执行，最终wallpaper会变成黑屏。

解决方式是在代码中规定.js被解析为text/javascript，避免被用户电脑本身的设置影响。

In render/server.py, Windows reads mimetypes from the registry. If the .js value in the registry has been incorrectly changed to text/plain by some software, all .js files in the bundle will be served as text/plain. With nosniff enabled, the browser will refuse to execute these files, ultimately causing the wallpaper to display a black screen.

The solution is to explicitly specify text/javascript as the MIME type for .js files in the code, preventing the behavior from being affected by the user's local system configuration.

Change class

• Routine fix, documentation, test, maintenance, or presentation-only UI
• Product-semantic or public-contract change discussed in the linked Issue
• Isolated, default-off experiment

Owning layer:

User-visible effect, or none:

Compatibility or migration impact, or none:

Evidence

Commands and manual journeys run:

• Relevant Python tests pass
• CPU/model-less baseline remains supported
• Electron npm run build passes when Electron code changed
• Dependency audit passes when dependencies changed
• Before/after screenshots are attached for visible UI changes
• Documentation/examples are updated for changed settings or contracts

Final check

• This PR addresses one coherent problem without unrelated cleanup
• It does not add a speculative API, fallback, or compatibility path
• No secrets, local state, model weights, voice material, or restricted assets are included
• Third-party notices and provenance are preserved

[Lucas1479]

Verified at head 85a3ec6. I reproduced polluted Windows MIME mappings before importing render.server and confirmed that GET, HEAD, and mounted asset responses recover text/javascript for .js/.mjs and application/wasm for .wasm. The focused local bridge/security suite passes (3/3), and both required Windows CI checks are green. No blocking issues; approved for main.