Player: only request fullscreen on real user clicks

The remote-control feature dispatches synthetic click events on the
player when the dashboard forwards touches. The global click handler
called requestFullscreen() on every click, but the browser only honors
that API for trusted user gestures — synthetic events rejected with
"Permissions check failed" / "API can only be initiated by a user
gesture", spamming the console for the duration of any remote session.

Gate the fullscreen request on event.isTrusted. Local user clicks still
trigger fullscreen; remote-control taps no longer try (and fail).
Bumped SW cache to v8.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/player/index.html

@@ -995,7 +995,13 @@
     }, 2000);
 
     // ==================== Fullscreen ====================
-    document.addEventListener('click', () => {
+    // Only attempt fullscreen on genuine user clicks. Synthetic clicks dispatched
+    // by the remote-control feature (touch forwarding from the dashboard) are not
+    // trusted by the browser and requestFullscreen() rejects with a "Permissions
+    // check failed" / "API can only be initiated by a user gesture" error every
+    // time, spamming the console.
+    document.addEventListener('click', (e) => {
+      if (!e.isTrusted) return;
       if (!document.fullscreenElement && config.paired) {
         document.documentElement.requestFullscreen?.() ||
         document.documentElement.webkitRequestFullscreen?.();

server/player/sw.js

@@ -1,4 +1,4 @@
-const CACHE_NAME = 'rd-player-v7';
+const CACHE_NAME = 'rd-player-v8';
 
 // Install: skip waiting to activate immediately
 self.addEventListener('install', (event) => {