fix(auth/images): long-lived Emby token, unthrottle refresh, serve library posters

Three regressions reported on third-party clients and the web UI:

- Third-party clients (Emby/Jellyfin) dropped login / could not play /
  could not refresh the library, roughly hourly. The Emby
  AuthenticateByName response returned the 60-minute access token, but
  Emby clients have no refresh mechanism and reuse the AccessToken until
  logout. Issue a long-lived (30d) token for the Emby compat layer via
  AuthService.IssueEmbyToken so device sessions persist.

- Web could be thrown back to login under load: /auth/refresh was inside
  the IP rate-limited /auth group, so multiple users/tabs behind one
  reverse-proxy/NAT IP exhausted the budget and refresh failed -> logout.
  Only login/register are rate-limited now (raised to 30/min for shared
  IPs); refresh is excluded (already protected by a one-time refresh token).

- Posters/images stopped displaying on the web home and other pages
  (refresh did not help). The SSRF/path hardening (a) blocked the image
  proxy whenever a hostname *resolved* to a private IP, which happens
  under GFW DNS poisoning of public CDNs like image.tmdb.org, and (b)
  restricted local image reads to data/cache/movies/tv/anime dirs only,
  dropping sidecar posters stored under arbitrary per-library roots to a
  placeholder. isPrivateHost now only blocks literal private/loopback IPs
  (real SSRF vectors) and ImageProxy also allows reads under configured
  library roots.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

internal/service/service.go

@@ -5,6 +5,7 @@ package service
 
 import (
 	"context"
+	"strings"
 	"time"
 
 	"go.uber.org/zap"
@@ -131,6 +132,24 @@ func New(cfg *config.Config, log *zap.Logger, repos *repository.Container) *Cont
 	downloads := NewDownloadService(log, repos, hub, organizer, siteSvc)
 	subscription := NewSubscriptionService(cfg, log, repos, downloads, siteSvc, hub)
 
+	// 让图片代理把媒体库根目录视为可读的本地图片位置：海报/封面等
+	// sidecar 资源就存放在这些（用户自定义、任意）目录下，否则会被
+	// 路径白名单挡掉、退化成占位图导致前端图片不显示。
+	imageProxy := NewImageProxy(cfg, log)
+	imageProxy.SetLibraryRootsProvider(func() []string {
+		libs, err := repos.Library.List(context.Background())
+		if err != nil {
+			return nil
+		}
+		roots := make([]string, 0, len(libs))
+		for _, l := range libs {
+			if strings.TrimSpace(l.Path) != "" {
+				roots = append(roots, l.Path)
+			}
+		}
+		return roots
+	})
+
 	ctx, cancel := context.WithCancel(context.Background())
 
 	return &Container{
@@ -152,7 +171,7 @@ func New(cfg *config.Config, log *zap.Logger, repos *repository.Container) *Cont
 		Scraper:         scraper,
 		Discover:        discover,
 		Playback:        NewPlaybackService(log, repos),
-		ImageProxy:      NewImageProxy(cfg, log),
+		ImageProxy:      imageProxy,
 		Watcher:         watcher,
 		Downloads:       downloads,
 		Subscription:    subscription,