Direct multi-year archive fetch is blocked by WSV's doubled CORS header

[bmmmm]

Why the page can't fetch the multi-year archive itself

Since May 2025 the WSV publishes each station's raw water-level archive back to 2000-01-01 as open data (DL-DE Zero) — as a ZIP behind POST /gast/historische-zeitreihen/prepare-download on pegelonline.wsv.de. pegel-visual supports it since d9dc354, but only via the manual flow (full archive (2000→) link → download ZIP → import), not with a one-click in-page fetch.

The blocker is upstream: every response under /gast/… and /webservices/files/… sends Access-Control-Allow-Origin: * twice, and browsers reject responses with multiple ACAO values outright, so any cross-origin fetch() fails even though the server clearly intends to allow it. The REST API (/webservices/rest-api/v2/) sends the header exactly once, which is why the live data on this page works.

Reproduce (checked 2026-07-16):

curl -sD- -o /dev/null 'https://www.pegelonline.wsv.de/webservices/files/' \
  | grep -ci access-control-allow-origin        # → 2
curl -sD- -o /dev/null 'https://www.pegelonline.wsv.de/webservices/rest-api/v2/stations/BONN/W.json' \
  | grep -ci access-control-allow-origin        # → 1

What this issue tracks

• Report the doubled header to the PEGELONLINE operators
• Once the /gast/historische-zeitreihen/ path sends a single ACAO header: add a direct "fetch full archive" action next to the existing link (POST prepare-download for the current station, follow the redirect, feed the bytes to the existing in-page ZIP reader), with the manual download+import flow as fallback

Until then the manual flow is the supported path — the README's "years, not days" section describes it.