[AlexAndBear]

Description

Guest SVG previews return 401 when Web and API use different origins because vue-inline-svg loads the DAV URL without guest cookies. Request SVGs with disposition: inline so the existing credentialed WebDAV client supplies a blob URL.

Follow-up to #3816. Audio/video keep their streaming URLs.

Related Issue

• Fixes Guest SVG previews fail when Web and API use different origins #3834

How Has This Been Tested?

• test environment: local Vite, backend rolling 8.1.0+40095460, separate Web/API origins; Chromium, Firefox and WebKit.
• test case 1: Guest and password-protected Public Links, single SVG and shared-folder SVGs; regular authenticated access. All render, including reload and next/previous navigation.
• test case 2: SVG blobs are revoked on close; PNG previews and video streaming still work. Guest DAV requests now include credentials and return 200 instead of 401.
• test case 3: pnpm check:types and pnpm lint pass; all 75 Preview unit tests pass. Full suite: 5,570 tests pass, but process exits with a DNS error for the unrelated some-link.com fixture.
• test case 4: Changed-file formatting passes. Full format check fails only on four existing ignored .playwright-mcp/*.yml recordings.

Types of changes

• Bugfix
• Enhancement (a change that doesn't break existing code or deployments)
• Breaking change (a modification that affects current functionality)
• Technical debt (addressing code that needs refactoring or improvements)
• Tests (adding or improving tests)
• Documentation (updates or additions to documentation)
• Maintenance (like dependency updates or tooling adjustments)