优化，排查项目问题

internal/service/image_proxy.go

@@ -13,9 +13,12 @@
 package service
 
 import (
+	"errors"
+	"net"
 	"net/http"
 	"path/filepath"
 	"sync"
+	"syscall"
 	"time"
 
 	"go.uber.org/zap"
@@ -52,6 +55,33 @@ func NewImageProxy(cfg *config.Config, log *zap.Logger) *ImageProxy {
 	// from image.tmdb.org via their HTTP proxy without extra config. On
 	// Windows we also honor the current user's system proxy settings.
 	transport := NewExternalTransport()
+	if proxyConfiguredForImageFetch() {
+		// 走本地代理（如 127.0.0.1:7890）时，拨号目标是代理本身，
+		// 连接层 SSRF 校验会误杀本地回环代理；此时沿用 URL 级校验。
+		log.Info("image proxy: outbound proxy detected, connection-level SSRF guard disabled")
+	} else {
+		// 仅 URL 解析层的 isPrivateHost 可被十进制/十六进制 IP、解析到
+		// 私网的域名与 DNS rebinding 绕过；在拨号层对最终连接 IP 做二次
+		// 校验（含重定向后的每条连接）堵住该旁路。
+		dialer := &net.Dialer{
+			Timeout: 15 * time.Second,
+			Control: func(_, address string, _ syscall.RawConn) error {
+				host, _, err := net.SplitHostPort(address)
+				if err != nil {
+					return err
+				}
+				ip := net.ParseIP(host)
+				if ip == nil {
+					return errors.New("image proxy: refusing non-IP dial target")
+				}
+				if isPrivateIP(ip) {
+					return errors.New("image proxy: requests to private/internal hosts are not allowed")
+				}
+				return nil
+			},
+		}
+		transport.DialContext = dialer.DialContext
+	}
 	return &ImageProxy{
 		cfg:      cfg,
 		log:      log,
@@ -60,6 +90,16 @@ func NewImageProxy(cfg *config.Config, log *zap.Logger) *ImageProxy {
 	}
 }
 
+// proxyConfiguredForImageFetch 探测环境变量或系统代理是否会影响图片抓取。
+func proxyConfiguredForImageFetch() bool {
+	req, err := http.NewRequest(http.MethodGet, "https://image.tmdb.org/", nil)
+	if err != nil {
+		return false
+	}
+	proxy, err := ProxyFromEnvironmentOrSystem(req)
+	return err == nil && proxy != nil
+}
+
 // SetLibraryRootsProvider injects a callback that returns the current set of
 // media library root directories. Sidecar posters live under these roots
 // (which are arbitrary, user-defined, and not necessarily under the