fix(auth/images): long-lived Emby token, unthrottle refresh, serve library posters

Three regressions reported on third-party clients and the web UI:

- Third-party clients (Emby/Jellyfin) dropped login / could not play /
  could not refresh the library, roughly hourly. The Emby
  AuthenticateByName response returned the 60-minute access token, but
  Emby clients have no refresh mechanism and reuse the AccessToken until
  logout. Issue a long-lived (30d) token for the Emby compat layer via
  AuthService.IssueEmbyToken so device sessions persist.

- Web could be thrown back to login under load: /auth/refresh was inside
  the IP rate-limited /auth group, so multiple users/tabs behind one
  reverse-proxy/NAT IP exhausted the budget and refresh failed -> logout.
  Only login/register are rate-limited now (raised to 30/min for shared
  IPs); refresh is excluded (already protected by a one-time refresh token).

- Posters/images stopped displaying on the web home and other pages
  (refresh did not help). The SSRF/path hardening (a) blocked the image
  proxy whenever a hostname *resolved* to a private IP, which happens
  under GFW DNS poisoning of public CDNs like image.tmdb.org, and (b)
  restricted local image reads to data/cache/movies/tv/anime dirs only,
  dropping sidecar posters stored under arbitrary per-library roots to a
  placeholder. isPrivateHost now only blocks literal private/loopback IPs
  (real SSRF vectors) and ImageProxy also allows reads under configured
  library roots.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

internal/service/auth.go

@@ -241,6 +241,33 @@ func (s *AuthService) IssueToken(u *model.User) (string, error) {
 	return t.SignedString([]byte(s.cfg.Secrets.JWTSecret))
 }
 
+// EmbyTokenDuration 是第三方 Emby/Jellyfin 客户端访问令牌的有效期。
+// Emby 协议没有 refresh token 机制——客户端登录一次后把 AccessToken
+// 长期保存并反复使用，直到用户主动登出。若给它们签发 60 分钟的普通
+// access token，客户端每小时就会掉登录、无法播放、媒体库无法刷新。
+// 因此为这些设备签发长期令牌（与 refresh token 一致的 30 天），匹配
+// Emby 持久化令牌的语义。
+const EmbyTokenDuration = 30 * 24 * time.Hour
+
+// IssueEmbyToken 为第三方客户端（Emby/Jellyfin 兼容层）签发一个长期
+// JWT。它与普通 access token 使用相同的密钥与 Claims，因此沿用现有的
+// EmbyAuthRequired 校验逻辑，只是有效期更长。
+func (s *AuthService) IssueEmbyToken(u *model.User) (string, error) {
+	claims := Claims{
+		UserID: u.ID,
+		Role:   u.Role,
+		Tier:   u.Tier,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(EmbyTokenDuration)),
+			Issuer:    "mediastationgo",
+			Subject:   u.ID,
+		},
+	}
+	t := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return t.SignedString([]byte(s.cfg.Secrets.JWTSecret))
+}
+
 // RefreshTokens 使用刷新令牌获取新的令牌对。
 func (s *AuthService) RefreshTokens(ctx context.Context, refreshToken string) (*TokenPair, error) {
 	return s.tokenSvc.Refresh(ctx, refreshToken)