Native mobile "Open" button fails with 401 for any PDF; in-app preview only shows an enlarged thumbnail of page 1, no real viewing

When opening any PDF (single or multi-page) from a regular authenticated session (not a public share) on a mobile device (Android, Chrome PWA), there is no way to actually view the document. Tapping the file only enlarges the thumbnail (a static image of page 1, or the only page), with no way to read the content properly — and there is no built-in multi-page PDF viewer to fall back to. The only alternative — tapping the file to trigger the native "Open/Download" screen and pressing "Open" ("Abrir") — fails with:

{"status":401,"message":"no token present in request"}

Expected behavior: The file should open correctly for an authenticated, logged-in user — either via a proper in-app multi-page PDF viewer, or by including the auth token in the native "Open" URL (the way /api/resources/preview?...&key=... already does).

What happens instead: The native "Open" flow issues several range requests (206 Partial Content) to the same /api/resources/download URL. The first request(s) succeed and are correctly authenticated (Santiago). However, a subsequent range request to that exact same URL, roughly 1 second later, fails with 401 and shows no authenticated user (N/A) — indicating the token/session is dropped on a later request to the same URL, not simply missing outright from the first one. This is consistent across different PDF files.

Environment:

• FileBrowser Quantum v1.5.6-stable (Docker image gtstef/filebrowser:latest)
• Self-hosted, accessed via Tailscale HTTPS reverse proxy
• Client: Android, Chrome, using the installed PWA
• No reverse proxy path issues (works fine for images, and for preview endpoint on desktop)

Steps to reproduce:

1. Log in normally (password auth) on Android, in the installed PWA
2. Navigate to any PDF
3. Tap the file → the "Open/Download" screen appears
4. Tap "Open" ("Abrir")
5. Observe 401 error

Relevant logs: GET | 200 | ... | Santiago | "/api/resources/download?source=srv&file=...pdf&inline=true" GET | 200 | ... | Santiago | "/api/resources/download?source=srv&file=...pdf&inline=true" GET | 401 | ... | N/A | "/api/resources/download?source=srv&file=...pdf&inline=true"

[with a different file, ~1 second gap] GET | 206 | ... | Santiago | "/api/resources/download?source=srv&file=...pdf&inline=true" GET | 401 | ... | N/A | "/api/resources/download?source=srv&file=...pdf&inline=true"

Additional context: This seems related to how the frontend builds the URL passed to the native OS "Open" handler — it doesn't appear to include an auth token (via auth= query param, which I understand is a supported auth method per discussion #1530), unlike the preview endpoint which does include a key= param and works correctly.