fix(web): tus uploads use per-origin token (federation auth)

packages/web/src/stores/instanceStore.ts

@@ -6,6 +6,7 @@ import {
   setApiForOriginResolver,
   setUserIdForOriginResolver,
   setOriginFromHostnameResolver,
+  setTokenForOriginResolver,
 } from '../utils/crossStoreResolvers';
 import { useSpaceStore } from './spaceStore';
 import { connectInstance, disconnectInstance as disconnectWs, disconnectAllRemote } from '../hooks/useWebSocket';
@@ -1112,6 +1113,18 @@ setUserIdForOriginResolver((origin: string): string | undefined => {
   return instance?.user.id;
 });
 
+// ─── Token resolution (federation) ────────────────────────────────────────────
+// Maps an origin to the JWT for that instance. Used by transferStore for tus
+// uploads and any other path that constructs raw HTTP requests to a federated
+// instance and needs to pass an Authorization header. Empty origin falls back
+// to the home-instance token from authStore.
+
+setTokenForOriginResolver((origin: string): string | null => {
+  if (!origin) return useAuthStore.getState().token;
+  const instance = useInstanceStore.getState().instances.find(i => i.origin === origin);
+  return instance?.token ?? null;
+});
+
 // ─── Electron: push connected-instance origins to main process ───────────────
 // Enables the main process to intercept invite URLs that point to instances
 // we're already signed into. Uses the basic subscribe(listener) form (no