fix: deliver session to service worker on first load (authenticated media)

[qingyun-wu]

Problem

With authenticated media enabled (MSC3916; mandatory on Synapse ≥ 1.131), images/media fail with 401 M_MISSING_TOKEN on a fresh load (first visit, hard refresh, incognito) and only work after a second reload.

pushSessionToSW posts the access token to the media service worker only when navigator.serviceWorker.controller is set. On first load the controller is null until the SW claims the page, so the token never reaches the SW before the first media fetches go out → 401 → broken images.

Closes #2990.

Fix

• src/sw-session.ts: when controller is null, fall back to navigator.serviceWorker.ready → registration.active so the session reaches the SW on first load.
• src/index.tsx: also re-push the session on controllerchange, once the SW takes control.

Two tiny changes, using existing patterns; no behavior change once the SW is already controlling the page.

Testing

Verified on a Synapse 1.153 deployment with authenticated media enforced: before, first-load media 401'd until reload; after, media loads on first load (incognito + unregistered-SW tested). navigator.serviceWorker.controller is null on that first load, which is the window this fixes.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}