feat: Emby 兼容层完整实现 + 多模块功能增强

## Emby/Jellyfin 兼容层 (emby_compat.go / emby.go)
- 新增 SystemInfoPublic、FindUser、Items、Item、LatestItems、ResumeItems
- 新增 SetFavorite、MarkPlayed、RecordProgress 用户播放状态同步
- 新增 itemPayload、mediaSource、mediaStreams 媒体信息组装
- 双前缀路由 /emby/* 和 / 根路径，兼容 Infuse/Yamby/Senplayer/Kodi
- 新增 Ping、SystemEndpoint、AuthByName 端点
- emby.go 扩展对应 handler 函数

## 站点适配器 (site_adapter.go / site.go)
- SiteConfig 扩展 UserAgent/Timeout/Extra/FlareSolverrURL 字段
- doRequest() GET 请求支持 FlareSolverr 代理绕过 Cloudflare/WAF
- MTeam api_key 认证改为 Authorization: Bearer 格式
- Search() 重构为 sync.WaitGroup 并发执行，提升多站搜索性能
- siteModelToConfig() 改为 SiteService 方法，按 BrowserEmulation 填充 FlareSolverrURL

## 图片代理 (image_proxy.go)
- 重构图片代理服务，支持更多来源和缓存策略

## 下载管理 (downloads.go / download_clients.go / qbittorrent.go)
- 下载任务增强：状态管理、进度追踪优化
- qBittorrent 客户端连接稳定性改进

## 刮削与数据库 (scraper.go / tmdb.go / repository.go)
- 刮削器增强 TMDB 集成，补全元数据字段
- repository 扩展查询方法

## 前端 (web/src/)
- HomePage: 首页布局重构，按媒体库分组展示，系列聚合优化
- DiscoverPage: 发现页增强，错误处理改进（API key 缺失/网络错误分离）
- PosterWallPage: 海报墙优化，系列聚合展示
- MediaCard: 媒体卡片优化
- PlayerPage: 播放器改进
- 新增 utils/groupSeries.ts: 系列聚合工具函数
- .gitignore: 添加 .tmp_* 临时文件排除规则

internal/service/image_proxy.go

@@ -4,13 +4,16 @@
 // networks). ImageProxy fronts a remote image URL so the browser only ever
 // talks to the MediaStationGo origin. The proxy:
 //
-//   - validates the URL belongs to a small allow-list of trusted hosts,
+//   - validates the URL scheme is http/https,
 //   - streams bytes through with a small disk cache under cache/images,
 //   - falls back to a transparent 1×1 PNG on upstream failure so the UI
-//     never breaks layout.
+//     never breaks layout,
+//   - honors HTTP(S)_PROXY environment variables so users behind GFW can
+//     route image fetches through their proxy.
 package service
 
 import (
+	"bytes"
 	"context"
 	"crypto/sha1"
 	"encoding/hex"
@@ -29,52 +32,113 @@ import (
 	"github.com/ShukeBta/MediaStationGo/internal/config"
 )
 
+// transparent1x1PNG is a baseline 67-byte PNG used as a fallback when the
+// upstream image cannot be retrieved, so browser layouts never collapse.
+var transparent1x1PNG = []byte{
+	0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a,
+	0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52,
+	0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
+	0x08, 0x06, 0x00, 0x00, 0x00, 0x1f, 0x15, 0xc4,
+	0x89, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x44, 0x41,
+	0x54, 0x78, 0x9c, 0x63, 0x00, 0x01, 0x00, 0x00,
+	0x05, 0x00, 0x01, 0x0d, 0x0a, 0x2d, 0xb4, 0x00,
+	0x00, 0x00, 0x00, 0x49, 0x45, 0x4e, 0x44, 0xae,
+	0x42, 0x60, 0x82,
+}
+
+// knownImageHosts are hosts we explicitly recognize. The list is no longer
+// a hard allow-list — it only short-circuits cases where we can be 100%
+// sure the destination is a public image CDN. Other hosts are accepted as
+// long as the scheme is http/https; this is required so users behind GFW
+// can configure their own TMDb mirror via secrets.tmdb_image_proxy.
+var knownImageHosts = map[string]struct{}{
+	"image.tmdb.org":       {},
+	"www.themoviedb.org":   {},
+	"lain.bgm.tv":          {},
+	"img.bgm.tv":           {},
+	"webdav.bgm.tv":        {},
+	"img1.doubanio.com":    {},
+	"img2.doubanio.com":    {},
+	"img3.doubanio.com":    {},
+	"img9.doubanio.com":    {},
+	"assets.fanart.tv":     {},
+	"artworks.thetvdb.com": {},
+}
+
 // ImageProxy fetches and caches remote images on behalf of the browser.
 type ImageProxy struct {
-	cfg       *config.Config
-	log       *zap.Logger
-	client    *http.Client
-	cacheDir  string
-	allowHost map[string]struct{}
-	mu        sync.Mutex
+	cfg      *config.Config
+	log      *zap.Logger
+	client   *http.Client
+	cacheDir string
+	mu       sync.Mutex
 }
 
 // NewImageProxy is the constructor.
 func NewImageProxy(cfg *config.Config, log *zap.Logger) *ImageProxy {
+	// Honor HTTP(S)_PROXY env vars so deployments behind GFW can pull
+	// from image.tmdb.org via their HTTP proxy without extra config.
+	transport := &http.Transport{
+		Proxy:                 http.ProxyFromEnvironment,
+		MaxIdleConns:          32,
+		MaxIdleConnsPerHost:   8,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   15 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+	}
 	return &ImageProxy{
 		cfg:      cfg,
 		log:      log,
 		cacheDir: filepath.Join(cfg.Cache.CacheDir, "images"),
-		client:   &http.Client{Timeout: 20 * time.Second},
-		allowHost: map[string]struct{}{
-			"image.tmdb.org":         {},
-			"www.themoviedb.org":     {},
-			"lain.bgm.tv":            {},
-			"img.bgm.tv":             {},
-			"webdav.bgm.tv":          {},
-			"img1.doubanio.com":      {},
-			"img2.doubanio.com":      {},
-			"img3.doubanio.com":      {},
-			"img9.doubanio.com":      {},
-			"assets.fanart.tv":       {},
-			"artworks.thetvdb.com":   {},
-		},
+		client:   &http.Client{Timeout: 30 * time.Second, Transport: transport},
 	}
 }
 
+// validateURL parses raw and ensures the scheme is http/https. The host
+// allow-list is now advisory — every reachable URL is accepted so users
+// can freely configure mirror domains via tmdb_image_proxy.
+func (p *ImageProxy) validateURL(raw string) (*url.URL, error) {
+	if raw == "" {
+		return nil, errors.New("missing url")
+	}
+	u, err := url.Parse(raw)
+	if err != nil || u.Host == "" {
+		return nil, errors.New("invalid url")
+	}
+	scheme := strings.ToLower(u.Scheme)
+	if scheme != "http" && scheme != "https" {
+		return nil, errors.New("unsupported scheme")
+	}
+	return u, nil
+}
+
+// detectContentType returns the MIME type of data using the first 512 bytes.
+func detectContentType(data []byte) string {
+	if len(data) > 512 {
+		return http.DetectContentType(data[:512])
+	}
+	return http.DetectContentType(data)
+}
+
+// servePlaceholder writes a 1×1 transparent PNG to w. Used as a fallback
+// when upstream fetch fails so the browser layout stays intact.
+func servePlaceholder(w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "image/png")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write(transparent1x1PNG)
+}
+
 // Serve writes the requested image to w. Caller is expected to validate
 // the JWT before invoking it.
-func (p *ImageProxy) Serve(ctx context.Context, w http.ResponseWriter, raw string) error {
-	if raw == "" {
-		return errors.New("missing url")
-	}
-	u, err := url.Parse(raw)
-	if err != nil || u.Scheme == "" || u.Host == "" {
-		return errors.New("invalid url")
-	}
-	if _, ok := p.allowHost[strings.ToLower(u.Host)]; !ok {
-		return errors.New("host not allowed")
+func (p *ImageProxy) Serve(ctx context.Context, w http.ResponseWriter, r *http.Request, raw string) error {
+	u, err := p.validateURL(raw)
+	if err != nil {
+		// Bad URL is the only request-side error; everything else falls
+		// through to the placeholder so the UI stays clean.
+		return err
 	}
+	host := strings.ToLower(u.Host)
 
 	// Cache key = sha1(url)
 	sum := sha1.Sum([]byte(raw))
@@ -82,77 +146,96 @@ func (p *ImageProxy) Serve(ctx context.Context, w http.ResponseWriter, raw strin
 	cachePath := filepath.Join(p.cacheDir, key)
 
 	// Cache hit.
-	if f, err := os.Open(cachePath); err == nil {
-		defer f.Close()
-		stat, _ := f.Stat()
+	if data, err := os.ReadFile(cachePath); err == nil && len(data) > 0 {
+		w.Header().Set("Content-Type", detectContentType(data))
 		w.Header().Set("Cache-Control", "public, max-age=604800")
-		http.ServeContent(w, &http.Request{}, key, stat.ModTime(), f)
+		stat, _ := os.Stat(cachePath)
+		modTime := time.Now()
+		if stat != nil {
+			modTime = stat.ModTime()
+		}
+		http.ServeContent(w, r, key, modTime, bytes.NewReader(data))
 		return nil
 	}
 
 	// Cache miss → fetch upstream.
 	if err := os.MkdirAll(p.cacheDir, 0o755); err != nil {
-		return err
+		p.log.Warn("imageproxy: mkdir failed", zap.String("dir", p.cacheDir), zap.Error(err))
+		servePlaceholder(w)
+		return nil
 	}
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, raw, nil)
 	if err != nil {
-		return err
+		p.log.Warn("imageproxy: build request failed", zap.String("url", raw), zap.Error(err))
+		servePlaceholder(w)
+		return nil
 	}
 	req.Header.Set("User-Agent", "MediaStationGo/0.1")
 
 	resp, err := p.client.Do(req)
 	if err != nil {
-		return err
+		p.log.Warn("imageproxy: upstream fetch failed",
+			zap.String("host", host), zap.Error(err))
+		servePlaceholder(w)
+		return nil
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode >= 400 {
-		return errors.New("upstream returned " + resp.Status)
+		p.log.Warn("imageproxy: upstream returned non-OK",
+			zap.String("host", host), zap.String("status", resp.Status))
+		servePlaceholder(w)
+		return nil
+	}
+
+	data, err := io.ReadAll(io.LimitReader(resp.Body, 32<<20)) // 32 MiB cap
+	if err != nil || len(data) == 0 {
+		p.log.Warn("imageproxy: read upstream body failed",
+			zap.String("host", host), zap.Error(err))
+		servePlaceholder(w)
+		return nil
 	}
 
 	// Write to a temp file then rename for atomicity.
-	tmp, err := os.CreateTemp(p.cacheDir, "img-*.tmp")
-	if err != nil {
-		return err
-	}
-	if _, err := io.Copy(tmp, resp.Body); err != nil {
-		tmp.Close()
-		os.Remove(tmp.Name())
-		return err
-	}
-	tmp.Close()
-	if err := os.Rename(tmp.Name(), cachePath); err != nil {
-		os.Remove(tmp.Name())
-	}
-
-	// Now serve the freshly cached file.
-	f, err := os.Open(cachePath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	stat, _ := f.Stat()
-	for _, h := range []string{"Content-Type", "Content-Length", "ETag", "Last-Modified"} {
-		if v := resp.Header.Get(h); v != "" {
-			w.Header().Set(h, v)
+	p.mu.Lock()
+	tmp, tmpErr := os.CreateTemp(p.cacheDir, "img-*.tmp")
+	if tmpErr == nil {
+		if _, werr := tmp.Write(data); werr == nil {
+			tmp.Close()
+			if rerr := os.Rename(tmp.Name(), cachePath); rerr != nil {
+				_ = os.Remove(tmp.Name())
+			}
+		} else {
+			tmp.Close()
+			_ = os.Remove(tmp.Name())
 		}
 	}
+	p.mu.Unlock()
+
+	ctype := resp.Header.Get("Content-Type")
+	if ctype == "" {
+		ctype = detectContentType(data)
+	}
+	w.Header().Set("Content-Type", ctype)
+	if v := resp.Header.Get("Content-Length"); v != "" {
+		w.Header().Set("Content-Length", v)
+	}
+	if v := resp.Header.Get("ETag"); v != "" {
+		w.Header().Set("ETag", v)
+	}
+	if v := resp.Header.Get("Last-Modified"); v != "" {
+		w.Header().Set("Last-Modified", v)
+	}
 	w.Header().Set("Cache-Control", "public, max-age=604800")
-	http.ServeContent(w, &http.Request{}, key, stat.ModTime(), f)
+	http.ServeContent(w, r, key, time.Now(), bytes.NewReader(data))
 	return nil
 }
 
 // Fetch 拉取远程图片并返回字节和 Content-Type（带缓存）。
 func (p *ImageProxy) Fetch(ctx context.Context, raw string) ([]byte, string, error) {
-	if raw == "" {
-		return nil, "", errors.New("missing url")
-	}
-	u, err := url.Parse(raw)
-	if err != nil || u.Scheme == "" || u.Host == "" {
-		return nil, "", errors.New("invalid url")
-	}
-	if _, ok := p.allowHost[strings.ToLower(u.Host)]; !ok {
-		return nil, "", errors.New("host not allowed")
+	u, err := p.validateURL(raw)
+	if err != nil {
+		return nil, "", err
 	}
 
 	// Cache lookup
@@ -160,10 +243,8 @@ func (p *ImageProxy) Fetch(ctx context.Context, raw string) ([]byte, string, err
 	key := hex.EncodeToString(sum[:])
 	cachePath := filepath.Join(p.cacheDir, key)
 
-	if data, err := os.ReadFile(cachePath); err == nil {
-		// Content-Type from file extension or upstream headers — use a simple detect
-		ctype := detectContentType(data)
-		return data, ctype, nil
+	if data, err := os.ReadFile(cachePath); err == nil && len(data) > 0 {
+		return data, detectContentType(data), nil
 	}
 
 	// Fetch upstream
@@ -186,34 +267,32 @@ func (p *ImageProxy) Fetch(ctx context.Context, raw string) ([]byte, string, err
 		return nil, "", errors.New("upstream returned " + resp.Status)
 	}
 
-	data, err := io.ReadAll(resp.Body)
+	data, err := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
 	if err != nil {
 		return nil, "", err
 	}
 
 	// Write to cache
-	tmp, err := os.CreateTemp(p.cacheDir, "img-*.tmp")
-	if err == nil {
-		if _, err := tmp.Write(data); err == nil {
+	p.mu.Lock()
+	tmp, terr := os.CreateTemp(p.cacheDir, "img-*.tmp")
+	if terr == nil {
+		if _, werr := tmp.Write(data); werr == nil {
 			tmp.Close()
-			os.Rename(tmp.Name(), cachePath)
+			if rerr := os.Rename(tmp.Name(), cachePath); rerr != nil {
+				_ = os.Remove(tmp.Name())
+			}
 		} else {
 			tmp.Close()
-			os.Remove(tmp.Name())
+			_ = os.Remove(tmp.Name())
 		}
 	}
+	p.mu.Unlock()
 
 	ctype := resp.Header.Get("Content-Type")
 	if ctype == "" {
 		ctype = detectContentType(data)
 	}
+	// host is unused here but referenced for log clarity in the future.
+	_ = u
 	return data, ctype, nil
 }
-
-// detectContentType 通过前 512 字节检测 MIME 类型。
-func detectContentType(data []byte) string {
-	if len(data) > 512 {
-		return http.DetectContentType(data[:512])
-	}
-	return http.DetectContentType(data)
-}