chore: bump version to 0.0.57 [skip ci]

优化上传逻辑

.dockerignore

@@ -18,7 +18,7 @@ verify-downloads/
 .tmp_*
 .tmp-deploy-*
 .tmp-deploy-data/
-.mediastation.pid
+.mmtl.pid
 *.db
 *.db-journal
 *.db-shm

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
-  - name: Telegram MediaStationGo 交流群
-    url: https://t.me/MediaStationGo
+  - name: Telegram MMTL 交流群
+    url: https://t.me/MMTL
     about: 适合快速交流部署经验、使用问题和排查线索。

.github/ISSUE_TEMPLATE/feature_request.md

@@ -12,7 +12,7 @@ assignees: ""
 
 ## 期望方案
 
-请描述你希望 MediaStationGo 如何工作。
+请描述你希望 MMTL 如何工作。
 
 ## 使用场景
 

.github/codeql/codeql-config.yml

@@ -1,4 +1,4 @@
-name: MediaStationGo CodeQL
+name: MMTL CodeQL
 
 paths-ignore:
   - internal/service/fileid_other.go

.github/workflows/Auto-docker-publish.yml

@@ -27,6 +27,9 @@ permissions:
 jobs:
   version-and-publish:
     runs-on: ubuntu-latest
+    outputs:
+      new_version: ${{ steps.bump_version.outputs.new_version }}
+      tag: ${{ steps.bump_version.outputs.tag }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -82,6 +85,7 @@ jobs:
           
           NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "tag=MMTL-v${NEW_VERSION}" >> $GITHUB_OUTPUT
           echo "tag=mmtl-v${NEW_VERSION}" >> $GITHUB_OUTPUT
 
       # 3. 更新 VERSION 文件
@@ -148,3 +152,117 @@ jobs:
             VERSION=${{ steps.bump_version.outputs.new_version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  # 单文件可执行构建：把前端打包进二进制（go:embed），交叉编译 Windows /
+  # Linux / macOS 的 amd64 / arm64 产物，作为 GitHub Release 附件发布。
+  build-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
+      - name: Install
+        working-directory: web
+        run: npm ci
+      - name: Build SPA
+        working-directory: web
+        run: npm run build
+      - name: Upload web/dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: web-dist
+          path: web/dist
+          retention-days: 1
+
+  # 先创建（幂等）空的 GitHub Release，供后续 build-binaries 并行上传附件，
+  # 也避免矩阵各 job 并发 upload 时 release 尚不存在而互相竞争。
+  publish-create-release:
+    needs: [version-and-publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ needs.version-and-publish.outputs.tag }}
+        run: |
+          set -eux
+          # tag 已由 version-and-publish 推送；若 release 已存在则忽略（--verify-tag 幂等）
+          gh release create "$RELEASE_TAG" \
+            --title "MMTL ${{ needs.version-and-publish.outputs.new_version }}" \
+            --notes "自动化发布 ${{ needs.version-and-publish.outputs.new_version }}" \
+            --verify-tag --latest || true
+
+  build-binaries:
+    needs: [version-and-publish, build-frontend, publish-create-release]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+            ext: ""
+          - goos: linux
+            goarch: arm64
+            ext: ""
+          - goos: windows
+            goarch: amd64
+            ext: .exe
+          - goos: windows
+            goarch: arm64
+            ext: .exe
+          - goos: darwin
+            goarch: amd64
+            ext: ""
+          - goos: darwin
+            goarch: arm64
+            ext: ""
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache: true
+      - name: Download web/dist
+        uses: actions/download-artifact@v4
+        with:
+          name: web-dist
+          path: web/dist
+      - name: Build binary
+        run: |
+          CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
+            go build -trimpath -ldflags="-s -w -X main.version=${{ needs.version-and-publish.outputs.tag }}" \
+            -o "dist/mmtl-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}" ./cmd/server
+      - name: Package
+        run: |
+          mkdir -p package/mmtl
+          cp "dist/mmtl-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}" package/mmtl/mmtl${{ matrix.ext }}
+          cp README.md package/mmtl/ 2>/dev/null || true
+          if [ "${{ matrix.goos }}" = "windows" ]; then
+            (cd package && zip -r "../mmtl_${{ matrix.goos }}_${{ matrix.goarch }}.zip" mmtl)
+          else
+            tar -czf "mmtl_${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz" -C package mmtl
+          fi
+      - name: Upload to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ needs.version-and-publish.outputs.tag }}
+        run: |
+          set -eux
+          PKG="mmtl_${{ matrix.goos }}_${{ matrix.goarch }}.zip"
+          TAR="mmtl_${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz"
+          # 并发上传到同一 release 各自文件，--clobber 幂等覆盖
+          if [ -f "$PKG" ]; then
+            for i in 1 2 3; do gh release upload "$RELEASE_TAG" "$PKG" --clobber && break || sleep 5; done
+          fi
+          if [ -f "$TAR" ]; then
+            for i in 1 2 3; do gh release upload "$RELEASE_TAG" "$TAR" --clobber && break || sleep 5; done
+          fi

.github/workflows/ci.yml

@@ -18,6 +18,19 @@ jobs:
           go-version: '1.25'
           cache: true
 
+      # The binary embeds the SPA (web/dist) via go:embed, so the dist must exist
+      # before the Go toolchain touches the `web` package.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
+      - name: Build SPA
+        working-directory: web
+        run: |
+          npm ci
+          npm run build
+
       - name: go vet
         run: go vet ./...
 

.github/workflows/docker-publish.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Image tag to publish, for example MediaStationGo-v0.0.32'
+        description: 'Image tag to publish, for example MMTL-v0.0.32'
         required: true
         type: string
       ref:
@@ -42,7 +42,7 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           # 自动使用当前仓库所有者
-          images: ghcr.io/${{ github.repository_owner }}/mediastation-go
+          images: ghcr.io/${{ github.repository_owner }}/mmtl
           tags: |
             type=raw,value=latest
             type=raw,value=${{ env.RELEASE_VERSION }}

.gitignore

@@ -32,7 +32,7 @@ logs/
 .tmp-deploy-cache/
 .tmp-deploy-server.*
 .tmp-live-server.*
-.mediastation.pid
+.mmtl.pid
 *.log
 *.db
 *.db-journal

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # 贡献规范
 
-感谢你愿意帮助 MediaStationGo 变得更稳定。这个项目主要面向 NAS、Docker 部署、媒体库整理、订阅下载和多端播放场景；提交 Issue 或 Pull Request 时，请尽量提供可复现、可验证的信息。
+感谢你愿意帮助 MMTL 变得更稳定。这个项目主要面向 NAS、Docker 部署、媒体库整理、订阅下载和多端播放场景；提交 Issue 或 Pull Request 时，请尽量提供可复现、可验证的信息。
 
 ## Issue 提交规范
 
@@ -16,7 +16,7 @@
 - 期望行为：你认为正确结果应该是什么。
 - 复现步骤：从哪个页面、点击什么、填写什么、触发什么任务。
 - 部署方式：Docker 第一档 / 第二档 / 第三档、裸机运行、反代方式等。
-- 环境信息：NAS 型号或系统、Docker / Compose 版本、浏览器、MediaStationGo 镜像版本。
+- 环境信息：NAS 型号或系统、Docker / Compose 版本、浏览器、MMTL 镜像版本。
 - 相关配置：路径映射、下载器保存路径、媒体库路径、站点类型等。请隐藏 Cookie、API Key、密码和 Token。
 - 日志和任务信息：优先提供应用日志、任务队列详情、浏览器控制台错误、网络请求错误。
 
@@ -28,14 +28,14 @@ Docker 部署常用命令：
 
 ```bash
 docker compose ps
-docker compose logs --tail=300 mediastation-go
-docker compose exec mediastation-go sh -lc 'ls -la /data/logs || true'
+docker compose logs --tail=300 mmtl
+docker compose exec mmtl sh -lc 'ls -la /data/logs || true'
 ```
 
 PostgreSQL 部署查询示例：
 
 ```bash
-docker compose exec postgres psql -U mediastation -d mediastation -c "select key,value,updated_at from settings order by updated_at desc limit 30;"
+docker compose exec postgres psql -U mmtl -d mmtl -c "select key,value,updated_at from settings order by updated_at desc limit 30;"
 ```
 
 请勿公开粘贴以下敏感信息：

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.6
 # =============================================================================
-# Multi-architecture build for MediaStationGo.
+# Multi-architecture build for MMTL.
 #
 # Stage 1 (frontend) :  Node 20  -> static SPA bundle
 # Stage 2 (backend)  :  Go 1.25  -> single static binary (CGO_ENABLED=0)
@@ -8,7 +8,7 @@
 #
 # Build:
 #   docker buildx build --platform linux/amd64,linux/arm64 \
-#     --build-arg VERSION=MediaStationGo-v0.1.16 -t mediastation-go:latest --push .
+#     --build-arg VERSION=MMTL-v0.1.16 -t mmtl:latest --push .
 #
 # Optional Intel VAAPI/QSV runtime packages:
 #   docker buildx build --build-arg WITH_VAAPI=true ...
@@ -39,7 +39,7 @@ COPY . .
 COPY --from=frontend /app/web/dist ./web/dist
 RUN --mount=type=cache,target=/go/pkg/mod \
     CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
-    go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o mediastation-go ./cmd/server
+    go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o mmtl ./cmd/server
 
 # ---- Stage 3: runtime ------------------------------------------------------
 FROM alpine:3.23
@@ -64,22 +64,22 @@ RUN apk add --no-cache \
     && rm -rf /var/cache/apk/*
 
 # Non-root user for the long-running process.
-RUN addgroup -S mediastation && adduser -S mediastation -G mediastation
+RUN addgroup -S mmtl && adduser -S mmtl -G mmtl
 
 WORKDIR /app
-COPY --from=backend /app/mediastation-go /usr/local/bin/mediastation-go
+COPY --from=backend /app/mmtl /usr/local/bin/mmtl
 COPY --from=frontend /app/web/dist /app/web/dist
 
 RUN mkdir -p /data /cache /media \
-    && chown -R mediastation:mediastation /data /cache /media
+    && chown -R mmtl:mmtl /data /cache /media
 
 # Default environment (overridable via docker-compose / `docker run -e`).
-ENV MEDIASTATION_APP_PORT=8080 \
-    MEDIASTATION_APP_DATA_DIR=/data \
-    MEDIASTATION_APP_WEB_DIR=/app/web/dist \
-    MEDIASTATION_DATABASE_DB_PATH=/data/mediastation.db \
-    MEDIASTATION_CACHE_CACHE_DIR=/cache \
-    MEDIASTATION_LOGGING_LEVEL=info \
+ENV MMTL_APP_PORT=8080 \
+    MMTL_APP_DATA_DIR=/data \
+    MMTL_APP_WEB_DIR=/app/web/dist \
+    MMTL_DATABASE_DB_PATH=/data/mmtl.db \
+    MMTL_CACHE_CACHE_DIR=/cache \
+    MMTL_LOGGING_LEVEL=info \
     TZ=Asia/Shanghai
 
 EXPOSE 8080

README.md

@@ -31,7 +31,7 @@
 
 ## 项目简介
 
-MediaStationGo 是一个自托管媒体管理系统，面向 NAS、小主机、家庭影音和多用户共享场景。它把媒体库、刮削、下载整理、订阅、网盘播放、Emby 协议兼容、用户权限和 Bot 通知放在一个后台里，目标是让用户只维护一套服务，就能给网页端、手机端、电视端和第三方播放器使用。
+MMTL 是一个自托管媒体管理系统，面向 NAS、小主机、家庭影音和多用户共享场景。它把媒体库、刮削、下载整理、订阅、网盘播放、Emby 协议兼容、用户权限和 Bot 通知放在一个后台里，目标是让用户只维护一套服务，就能给网页端、手机端、电视端和第三方播放器使用。
 
 核心能力：
 
@@ -77,7 +77,7 @@ GHCR：ghcr.io/truewhile/mmtl:latest
 
 ## 部署档位
 
-MediaStationGo 推荐按机器资源和用户规模选择部署档位。每份 Compose 文件都是完整文件，不需要再叠加多个 `-f`。想一个镜像跑起来就选单镜像档（SQLite）；需要多用户 / 高并发时再用 PostgreSQL 三档。Redis 和 OpenSearch 是增强组件，不替代 PostgreSQL。
+MMTL 推荐按机器资源和用户规模选择部署档位。每份 Compose 文件都是完整文件，不需要再叠加多个 `-f`。想一个镜像跑起来就选单镜像档（SQLite）；需要多用户 / 高并发时再用 PostgreSQL 三档。Redis 和 OpenSearch 是增强组件，不替代 PostgreSQL。
 
 | 档位 | 完整配置文件 | 组件 | 适合场景 |
 | --- | --- | --- | --- |
@@ -119,12 +119,12 @@ volumes:
 关键数据目录：
 
 ```text
-./data       JWT 密钥、运行配置、SQLite 主数据库（mediastation.db）——必须备份
+./data       JWT 密钥、运行配置、SQLite 主数据库（mmtl.db）——必须备份
 ./cache      海报/临时缓存，可重建
 ./media      媒体库
 ```
 
-> 单镜像模式请不要配置 `MEDIASTATION_DATABASE_DSN`；一旦填了 DSN 就会切回 PostgreSQL。
+> 单镜像模式请不要配置 `MMTL_DATABASE_DSN`；一旦填了 DSN 就会切回 PostgreSQL。
 
 ### 第一档：PostgreSQL
 
@@ -176,10 +176,10 @@ OpenSearch 数据目录是 `./opensearch`。搜索索引可重建，但重建大
 仓库内提供四份推荐 Compose 文件：
 
 ```text
-docker-compose.simple.yml     单镜像档：MediaStationGo + 内置 SQLite
-docker-compose.yml            第一档：MediaStationGo + PostgreSQL
-docker-compose.standard.yml   第二档：MediaStationGo + PostgreSQL + Redis
-docker-compose.search.yml     第三档：MediaStationGo + PostgreSQL + Redis + OpenSearch
+docker-compose.simple.yml     单镜像档：MMTL + 内置 SQLite
+docker-compose.yml            第一档：MMTL + PostgreSQL
+docker-compose.standard.yml   第二档：MMTL + PostgreSQL + Redis
+docker-compose.search.yml     第三档：MMTL + PostgreSQL + Redis + OpenSearch
 ```
 
 仓库只保留面向用户部署和项目维护的必要文件。旧的本地部署脚本、发包脚本、开发机辅助脚本、`.env` 示例和旧高级 Compose 模板已经移除；Linux / Docker 用户按上面四个 Compose 文件部署即可。开发者本地生成的 `bin/`、`data/`、`cache/`、`logs/`、`.tmp/`、`tools/` 等目录已列入 `.gitignore`，不应提交到仓库。
@@ -202,7 +202,7 @@ docker compose -f docker-compose.search.yml up -d
 
 ```yaml
 services:
-  mediastation-go:
+  mmtl:
     image: ghcr.io/truewhile/MMTL:latest
     ports:
       # 左边是宿主机访问端口，右边是容器内端口。
@@ -220,17 +220,17 @@ services:
       TZ: Asia/Shanghai
 
       # PostgreSQL 主数据库。
-      MEDIASTATION_DATABASE_TYPE: postgres
-      MEDIASTATION_DATABASE_DSN: postgres://mediastation:mediastation@postgres:5432/mediastation?sslmode=disable
+      MMTL_DATABASE_TYPE: postgres
+      MMTL_DATABASE_DSN: postgres://mmtl:mmtl@postgres:5432/mmtl?sslmode=disable
 
-      # 旧 SQLite 迁移源：只在从旧版 data/mediastation.db 导入时使用。
-      MEDIASTATION_DATABASE_DB_PATH: /data/mediastation.db
+      # 旧 SQLite 迁移源：只在从旧版 data/mmtl.db 导入时使用。
+      MMTL_DATABASE_DB_PATH: /data/mmtl.db
 
       # 路径换算：宿主机路径和容器路径必须一一对应。
-      MEDIASTATION_MEDIA_DIR: /vol1/1000/Media
-      MEDIASTATION_MEDIA_CONTAINER_DIR: /media
-      MEDIASTATION_DOWNLOAD_DIR: /vol1/1000/Downloads
-      MEDIASTATION_DOWNLOAD_CONTAINER_DIR: /downloads
+      MMTL_MEDIA_DIR: /vol1/1000/Media
+      MMTL_MEDIA_CONTAINER_DIR: /media
+      MMTL_DOWNLOAD_DIR: /vol1/1000/Downloads
+      MMTL_DOWNLOAD_CONTAINER_DIR: /downloads
 ```
 
 ## 路径映射
@@ -244,10 +244,10 @@ volumes:
   - /vol1/1000/Docker/moviepilot-v2/media:/vol1/1000/Docker/moviepilot-v2/media
   - /vol1/1000/qBittorrent/downloads:/vol1/1000/qBittorrent/downloads
 environment:
-  MEDIASTATION_MEDIA_DIR: /vol1/1000/Docker/moviepilot-v2/media
-  MEDIASTATION_MEDIA_CONTAINER_DIR: /vol1/1000/Docker/moviepilot-v2/media
-  MEDIASTATION_DOWNLOAD_DIR: /vol1/1000/qBittorrent/downloads
-  MEDIASTATION_DOWNLOAD_CONTAINER_DIR: /vol1/1000/qBittorrent/downloads
+  MMTL_MEDIA_DIR: /vol1/1000/Docker/moviepilot-v2/media
+  MMTL_MEDIA_CONTAINER_DIR: /vol1/1000/Docker/moviepilot-v2/media
+  MMTL_DOWNLOAD_DIR: /vol1/1000/qBittorrent/downloads
+  MMTL_DOWNLOAD_CONTAINER_DIR: /vol1/1000/qBittorrent/downloads
 ```
 
 Windows Docker Desktop 示例：
@@ -256,20 +256,20 @@ Windows Docker Desktop 示例：
 volumes:
   - D:/Media:/media
 environment:
-  MEDIASTATION_MEDIA_DIR: D:/Media
-  MEDIASTATION_MEDIA_CONTAINER_DIR: /media
+  MMTL_MEDIA_DIR: D:/Media
+  MMTL_MEDIA_CONTAINER_DIR: /media
 ```
 
 如果后台添加媒体库时填的是 `/vol1/...`，Compose 里也建议把同一个 `/vol1/...` 挂进容器，避免自动整理和下载入库时路径不可访问。
 
 ## 旧 SQLite 迁移
 
-新版推荐 PostgreSQL 作为主数据库。`MEDIASTATION_DATABASE_DB_PATH` 不是主库路径，而是旧 SQLite 数据的迁移源。
+新版推荐 PostgreSQL 作为主数据库。`MMTL_DATABASE_DB_PATH` 不是主库路径，而是旧 SQLite 数据的迁移源。
 
 迁移步骤：
 
-1. 把旧版 `mediastation.db` 放到 `./data/mediastation.db`。
-2. 保持 `MEDIASTATION_DATABASE_DB_PATH: /data/mediastation.db`。
+1. 把旧版 `mmtl.db` 放到 `./data/mmtl.db`。
+2. 保持 `MMTL_DATABASE_DB_PATH: /data/mmtl.db`。
 3. 启动一次，确认日志显示迁移完成，网页数据正常。
 4. 备份 `./postgres` 和 `./data`。
 5. 确认不再需要 SQLite 后，把迁移源改成不存在的路径，例如：
@@ -277,7 +277,7 @@ environment:
 ```yaml
 environment:
   # 已完成 SQLite 迁移后，建议改成不存在的路径，避免下次启动重复检查旧库。
-  MEDIASTATION_DATABASE_DB_PATH: /data/no-sqlite-migration.db
+  MMTL_DATABASE_DB_PATH: /data/no-sqlite-migration.db
 ```
 
 不要删除 `./postgres`。PostgreSQL 已经是主数据库，删除它会丢失账号、媒体库、订阅、配置和历史数据。
@@ -287,36 +287,36 @@ environment:
 Compose 模板默认把完整应用日志写入 `./data/logs/app.log`，同时拆分 `./data/logs/warn.log` 和 `./data/logs/error.log`。Docker 自身日志也会保留 10 个 50MB 文件：
 
 ```bash
-docker compose logs -f mediastation-go
+docker compose logs -f mmtl
 tail -f ./data/logs/app.log
 tail -f ./data/logs/error.log
 ```
 
-如果要排查订阅、站点搜索、自动整理或 STRM 生成问题，保持 `MEDIASTATION_LOGGING_LEVEL: info`；需要更细日志时临时改成 `debug`，确认后再改回 `info`。
+如果要排查订阅、站点搜索、自动整理或 STRM 生成问题，保持 `MMTL_LOGGING_LEVEL: info`；需要更细日志时临时改成 `debug`，确认后再改回 `info`。
 
-STRM 输出目录请使用容器内可写路径，例如 `/data/strm`，或你已经挂载进容器的媒体目录。旧版本保存过 `/app/data/strm` 的部署会在生成时自动迁移到当前 `MEDIASTATION_APP_DATA_DIR`，默认就是 `/data`。
+STRM 输出目录请使用容器内可写路径，例如 `/data/strm`，或你已经挂载进容器的媒体目录。旧版本保存过 `/app/data/strm` 的部署会在生成时自动迁移到当前 `MMTL_APP_DATA_DIR`，默认就是 `/data`。
 
 ## 更新与备份
 
 更新镜像：
 
 ```bash
-docker compose pull mediastation-go
-docker compose up -d --no-deps mediastation-go
+docker compose pull mmtl
+docker compose up -d --no-deps mmtl
 ```
 
-不要执行裸 `docker compose pull` 做日常更新。PostgreSQL / Redis / OpenSearch 是数据与缓存基础组件，compose 已设置为 `pull_policy: missing`，首次部署缺镜像时会拉取，日常更新只建议拉取 `mediastation-go`。需要升级这些基础组件时，请先备份 `./postgres`，再手动修改镜像版本并单独拉取。
+不要执行裸 `docker compose pull` 做日常更新。PostgreSQL / Redis / OpenSearch 是数据与缓存基础组件，compose 已设置为 `pull_policy: missing`，首次部署缺镜像时会拉取，日常更新只建议拉取 `mmtl`。需要升级这些基础组件时，请先备份 `./postgres`，再手动修改镜像版本并单独拉取。
 
 如果第二档或第三档保留了原始文件名，更新时指定对应完整文件：
 
 ```bash
 # 第二档
-docker compose -f docker-compose.standard.yml pull mediastation-go
-docker compose -f docker-compose.standard.yml up -d --no-deps mediastation-go
+docker compose -f docker-compose.standard.yml pull mmtl
+docker compose -f docker-compose.standard.yml up -d --no-deps mmtl
 
 # 第三档
-docker compose -f docker-compose.search.yml pull mediastation-go
-docker compose -f docker-compose.search.yml up -d --no-deps mediastation-go
+docker compose -f docker-compose.search.yml pull mmtl
+docker compose -f docker-compose.search.yml up -d --no-deps mmtl
 ```
 
 必须备份：
@@ -338,7 +338,7 @@ docker compose -f docker-compose.search.yml up -d --no-deps mediastation-go
 
 **启动后还是反复迁移 SQLite？**
 
-确认旧数据已经迁移成功后，把 `MEDIASTATION_DATABASE_DB_PATH` 改成不存在的路径，例如 `/data/no-sqlite-migration.db`，然后重启容器。
+确认旧数据已经迁移成功后，把 `MMTL_DATABASE_DB_PATH` 改成不存在的路径，例如 `/data/no-sqlite-migration.db`，然后重启容器。
 
 **扫库或入库速度很慢？**
 
@@ -346,7 +346,7 @@ docker compose -f docker-compose.search.yml up -d --no-deps mediastation-go
 
 **qBittorrent 下载完成后无法整理？**
 
-确认 qBittorrent 保存路径已经通过 `volumes` 挂载进 MediaStationGo 容器，并且 `MEDIASTATION_DOWNLOAD_DIR` 与 `MEDIASTATION_DOWNLOAD_CONTAINER_DIR` 对应正确。
+确认 qBittorrent 保存路径已经通过 `volumes` 挂载进 MMTL 容器，并且 `MMTL_DOWNLOAD_DIR` 与 `MMTL_DOWNLOAD_CONTAINER_DIR` 对应正确。
 
 **硬链接目录在 Docker / NAS 上看不到内容？**
 
@@ -354,21 +354,23 @@ docker compose -f docker-compose.search.yml up -d --no-deps mediastation-go
 
 **第三方播放器无法连接？**
 
-确认播放器填写的是 `http://服务器IP:18080`，账号密码使用 MediaStationGo 用户账号。反代部署时需要正确设置外部访问地址和 HTTPS 头。
+确认播放器填写的是 `http://服务器IP:18080`，账号密码使用 MMTL 用户账号。反代部署时需要正确设置外部访问地址和 HTTPS 头。
 
 ## 开发构建
 
 本地开发需要 Go、Node.js 和 npm。
 
+后端会将 `web/dist` 通过 `go:embed` 编进二进制，因此**在编译 / 运行后端之前要先构建前端**，否则 `web` 包会因为缺少嵌入资源而编译失败。
+
 ```bash
+# 前端依赖与构建（必须先做，产物被 go:embed 打进二进制）
+npm --prefix web ci
+npm --prefix web run build
+
 # 后端测试
 go test ./...
 
-# 前端依赖与构建
-npm --prefix web install
-npm --prefix web run build
-
-# 本地运行后端
+# 本地运行后端（二进制自带前端界面，无需额外 web 目录）
 go run ./cmd/server
 
 # 本地运行前端开发服务器
@@ -387,6 +389,21 @@ http://127.0.0.1:3000
 http://127.0.0.1:8080/api/health
 ```
 
+### 交叉编译单文件发布物
+
+CI（`.github/workflows/Auto-docker-publish.yml`）每次发布会自动为 Windows / Linux(含 Debian) / macOS 交叉编译 amd64 + arm64 的单文件可执行程序，并上传到对应的 GitHub Release。你可以在 Releases 页面下载 `.zip`（Windows）或 `.tar.gz`（Linux / macOS）附件，解压后直接运行其中的 `mmtl`（Windows 为 `mmtl.exe`），无需额外携带前端目录。
+
+本地手动交叉编译某个平台：
+
+```bash
+# 先构建前端
+npm --prefix web ci && npm --prefix web run build
+
+# 例如：构建 Linux amd64 单文件
+CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+  go build -trimpath -ldflags="-s -w" -o mmtl-linux-amd64 ./cmd/server
+```
+
 ## 贡献与反馈
 
 提交 Bug、功能建议或 Pull Request 前，请先阅读 [贡献规范](CONTRIBUTING.md)。
@@ -400,11 +417,11 @@ http://127.0.0.1:8080/api/health
 
 ## Star History
 
-<a href="https://www.star-history.com/?repos=ShukeBta%2FMediaStationGo&type=date&legend=top-left">
+<a href="https://www.star-history.com/?repos=ShukeBta%2FMMTL&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ShukeBta/MediaStationGo&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=ShukeBta/MediaStationGo&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=ShukeBta/MediaStationGo&type=date&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ShukeBta/MMTL&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=ShukeBta/MMTL&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=ShukeBta/MMTL&type=date&legend=top-left" />
  </picture>
 </a>
 

README_EN.md

@@ -29,14 +29,14 @@
 
 ## What is it?
 
-MediaStationGo is a self-hosted media center for personal libraries, home NAS, and home-theater users.
+MMTL is a self-hosted media center for personal libraries, home NAS, and home-theater users.
 
 It helps you:
 
 - Manage movies, TV shows, anime, variety shows, music, and adult libraries.
 - Create multiple user accounts for family members, friends, or different devices.
 - Scan files and enrich posters, summaries, years, seasons, and episodes.
-- Play in the web UI, or log in with a MediaStationGo account from Emby-protocol apps such as Infuse, VidHub, SenPlayer, and Emby clients.
+- Play in the web UI, or log in with a MMTL account from Emby-protocol apps such as Infuse, VidHub, SenPlayer, and Emby clients.
 - Connect qBittorrent for search, subscriptions, downloads, and post-download organization.
 - Connect OpenList, CloudDrive2, WebDAV, and other storage backends with STRMURL or 302 redirect playback.
 - Run on NAS, mini PCs, VPS, Linux, Windows Docker Desktop, or any Docker-friendly host.
@@ -47,8 +47,8 @@ It helps you:
 
 ## Key Highlights
 
-- **One server, many clients**: deploy MediaStationGo once; you do not need to run a separate Emby server.
-- **Emby-protocol compatibility**: add the server in third-party players as an Emby/Jellyfin-compatible server, then log in with your MediaStationGo username and password.
+- **One server, many clients**: deploy MMTL once; you do not need to run a separate Emby server.
+- **Emby-protocol compatibility**: add the server in third-party players as an Emby/Jellyfin-compatible server, then log in with your MMTL username and password.
 - **Multi-user management**: supports admins, regular users, account enable/disable, expiry dates, device management, Bot registration, and redeem codes.
 - **Local + cloud media in one place**: manage local disks, download folders, OpenList, CloudDrive2, WebDAV, and other storage backends from one panel.
 - **Download-to-library workflow**: connect qBittorrent for search, subscriptions, download completion organization, and metadata matching.
@@ -61,7 +61,7 @@ It helps you:
 - **Beginners** who want to edit one `docker-compose.yml` and start the service.
 - **NAS users** who want a low-resource media center for local disks and cloud storage.
 - **PT/download users** who want downloads, organization, metadata, and playback in one panel.
-- **External-player users** who want to log in to Emby-protocol third-party apps with one MediaStationGo account.
+- **External-player users** who want to log in to Emby-protocol third-party apps with one MMTL account.
 - **Family-sharing users** who want separate user accounts without deploying a separate media server for each person.
 - **Developers** who want to study or extend a Go + React self-hosted media app.
 
@@ -82,12 +82,12 @@ It helps you:
 Docker Compose is the recommended path. Beginners do not need `.env`, bare-metal binaries, or source builds. Use the single-image SQLite template if you want the smallest possible setup.
 
 ```bash
-mkdir -p MediaStationGo
-cd MediaStationGo
-# Simplest option: one MediaStationGo container + SQLite
-curl -fsSL https://raw.githubusercontent.com/ShukeBta/MediaStationGo/main/docker-compose.simple.yml -o docker-compose.yml
-# Or tier 1: MediaStationGo + PostgreSQL
-# curl -fsSL https://raw.githubusercontent.com/ShukeBta/MediaStationGo/main/docker-compose.yml -o docker-compose.yml
+mkdir -p MMTL
+cd MMTL
+# Simplest option: one MMTL container + SQLite
+curl -fsSL https://raw.githubusercontent.com/ShukeBta/MMTL/main/docker-compose.simple.yml -o docker-compose.yml
+# Or tier 1: MMTL + PostgreSQL
+# curl -fsSL https://raw.githubusercontent.com/ShukeBta/MMTL/main/docker-compose.yml -o docker-compose.yml
 ```
 
 Edit `docker-compose.yml`:
@@ -119,9 +119,9 @@ Password: admin123
 
 ## Docker Compose Recommended
 
-The repository `docker-compose.yml` is the lightweight recommended template: no `.env` required, and by default it only starts `MediaStationGo + PostgreSQL`. This is the best starting point for most NAS users.
+The repository `docker-compose.yml` is the lightweight recommended template: no `.env` required, and by default it only starts `MMTL + PostgreSQL`. This is the best starting point for most NAS users.
 
-If you already have an older `./data/mediastation.db`, the first start with the new compose file automatically imports it into PostgreSQL. Keep `./data`; it still stores the JWT secret, runtime data, and the old SQLite migration source.
+If you already have an older `./data/mmtl.db`, the first start with the new compose file automatically imports it into PostgreSQL. Keep `./data`; it still stores the JWT secret, runtime data, and the old SQLite migration source.
 
 ### Deployment modes
 
@@ -134,7 +134,7 @@ If you already have an older `./data/mediastation.db`, the first start with the
 
 Each compose file is standalone. Do not stack multiple `-f` files together.
 
-The single-image `docker-compose.simple.yml` runs only MediaStationGo with a built-in SQLite database — the simplest starting point. Do not set `MEDIASTATION_DATABASE_DSN` there, or it switches back to PostgreSQL. Move up to the PostgreSQL modes for multi-user or high-concurrency use (keep `./data` when you switch). Redis and OpenSearch are enhancement layers, not source databases. Do not enable OpenSearch by default on low-memory NAS devices.
+The single-image `docker-compose.simple.yml` runs only MMTL with a built-in SQLite database — the simplest starting point. Do not set `MMTL_DATABASE_DSN` there, or it switches back to PostgreSQL. Move up to the PostgreSQL modes for multi-user or high-concurrency use (keep `./data` when you switch). Redis and OpenSearch are enhancement layers, not source databases. Do not enable OpenSearch by default on low-memory NAS devices.
 
 ### Database Choice And Disabling SQLite
 
@@ -142,14 +142,14 @@ The current Docker Compose setup uses PostgreSQL by default. SQLite is no longer
 
 ```yaml
 environment:
-  MEDIASTATION_DATABASE_TYPE: postgres
-  MEDIASTATION_DATABASE_DSN: postgres://mediastation:mediastation@postgres:5432/mediastation?sslmode=disable
+  MMTL_DATABASE_TYPE: postgres
+  MMTL_DATABASE_DSN: postgres://mmtl:mmtl@postgres:5432/mmtl?sslmode=disable
 ```
 
-`MEDIASTATION_DATABASE_DB_PATH` is only used as a one-time migration source for old SQLite data:
+`MMTL_DATABASE_DB_PATH` is only used as a one-time migration source for old SQLite data:
 
 - Fresh installs: `docker compose up -d` uses PostgreSQL and does not create a new SQLite primary database.
-- Upgrades: if `./data/mediastation.db` exists, the first start with the new compose file imports it into PostgreSQL.
+- Upgrades: if `./data/mmtl.db` exists, the first start with the new compose file imports it into PostgreSQL.
 - Migration fills missing rows by primary key and skips rows that already exist. If it fails partway through, a later start continues the remaining tables.
 - After a successful import, PostgreSQL gets a completion marker in the `settings` table, so the old SQLite file is not imported again.
 - Redis is a hot cache and OpenSearch is a search index; neither is a source database.
@@ -157,9 +157,9 @@ environment:
 Recommended SQLite to PostgreSQL upgrade flow:
 
 ```bash
-docker compose pull mediastation-go
-docker compose up -d --no-deps mediastation-go
-docker compose logs -f mediastation-go
+docker compose pull mmtl
+docker compose up -d --no-deps mmtl
+docker compose logs -f mmtl
 ```
 
 After you see `sqlite data migrated to postgres`, or after the web UI shows your users, libraries, and settings correctly, you can stop using the old SQLite file as a migration source.
@@ -170,15 +170,15 @@ To make the deployment PostgreSQL-only after migration, keep PostgreSQL selected
 
 ```yaml
 environment:
-  MEDIASTATION_DATABASE_TYPE: postgres
-  MEDIASTATION_DATABASE_DSN: postgres://mediastation:mediastation@postgres:5432/mediastation?sslmode=disable
-  MEDIASTATION_DATABASE_DB_PATH: /data/disabled-sqlite-migration.db
+  MMTL_DATABASE_TYPE: postgres
+  MMTL_DATABASE_DSN: postgres://mmtl:mmtl@postgres:5432/mmtl?sslmode=disable
+  MMTL_DATABASE_DB_PATH: /data/disabled-sqlite-migration.db
 ```
 
 Then rename or move the old host-side SQLite file as an offline backup:
 
 ```bash
-mv data/mediastation.db data/mediastation.sqlite.bak
+mv data/mmtl.db data/mmtl.sqlite.bak
 ```
 
 For bare-metal or custom `config.yaml` deployments, use the same idea:
@@ -186,7 +186,7 @@ For bare-metal or custom `config.yaml` deployments, use the same idea:
 ```yaml
 database:
   type: postgres
-  dsn: postgres://mediastation:mediastation@127.0.0.1:5432/mediastation?sslmode=disable
+  dsn: postgres://mmtl:mmtl@127.0.0.1:5432/mmtl?sslmode=disable
   db_path: ""
 ```
 
@@ -198,15 +198,15 @@ Both image sources are supported. Pick one and put it in `image:`:
 
 | Source | Image | Best for |
 | --- | --- | --- |
-| GitHub Container Registry (GHCR) | `ghcr.io/shukebta/mediastation-go:latest` | Recommended default, follows repository releases |
-| Docker Hub | `shukbet/mediastationgo:latest` | Backup source when GHCR is slow or unavailable |
+| GitHub Container Registry (GHCR) | `ghcr.io/shukebta/mmtl:latest` | Recommended default, follows repository releases |
+| Docker Hub | `shukbet/mmtl:latest` | Backup source when GHCR is slow or unavailable |
 
 To pin a version, first confirm the tag exists on the repository Packages page. Use this format:
 
 ```yaml
-image: ghcr.io/shukebta/mediastation-go:<version-tag>
+image: ghcr.io/shukebta/mmtl:<version-tag>
 # If GHCR does not have that tag, use Docker Hub as the backup:
-# image: shukbet/mediastationgo:MediaStationGo-v0.0.72
+# image: shukbet/mmtl:MMTL-v0.0.72
 ```
 
 For the simplest setup, keep GHCR `latest`.
@@ -215,10 +215,10 @@ Manual pull examples:
 
 ```bash
 # GitHub Container Registry
-docker pull ghcr.io/shukebta/mediastation-go:latest
+docker pull ghcr.io/shukebta/mmtl:latest
 
 # Docker Hub backup
-docker pull shukbet/mediastationgo:latest
+docker pull shukbet/mmtl:latest
 ```
 
 Focus on this part:
@@ -260,8 +260,8 @@ volumes:
   - /vol1/1000/Downloads:/downloads
 
 environment:
-  MEDIASTATION_MEDIA_DIR: /vol1/1000/Media
-  MEDIASTATION_DOWNLOAD_DIR: /vol1/1000/Downloads
+  MMTL_MEDIA_DIR: /vol1/1000/Media
+  MMTL_DOWNLOAD_DIR: /vol1/1000/Downloads
 ```
 
 Rules:
@@ -279,12 +279,12 @@ The root `docker-compose.yml` follows this style:
 
 ```yaml
 services:
-  mediastation-go:
+  mmtl:
     # Pick one image source:
     # GitHub Container Registry (GHCR):
-    image: ghcr.io/shukebta/mediastation-go:latest
+    image: ghcr.io/shukebta/mmtl:latest
     # Docker Hub backup:
-    # image: shukbet/mediastationgo:latest
+    # image: shukbet/mmtl:latest
 
     restart: unless-stopped
     init: true
@@ -326,38 +326,38 @@ services:
       PUID: "1000"
       PGID: "1000"
 
-      MEDIASTATION_APP_HOST: 0.0.0.0
-      MEDIASTATION_APP_PORT: 8080
-      MEDIASTATION_APP_WEB_DIR: /app/web/dist
-      MEDIASTATION_APP_DATA_DIR: /data
+      MMTL_APP_HOST: 0.0.0.0
+      MMTL_APP_PORT: 8080
+      MMTL_APP_WEB_DIR: /app/web/dist
+      MMTL_APP_DATA_DIR: /data
 
       # Lightweight mode uses PostgreSQL by default.
       # Old SQLite data migrates from this path on first start.
-      MEDIASTATION_DATABASE_TYPE: postgres
-      MEDIASTATION_DATABASE_DSN: postgres://mediastation:mediastation@postgres:5432/mediastation?sslmode=disable
+      MMTL_DATABASE_TYPE: postgres
+      MMTL_DATABASE_DSN: postgres://mmtl:mmtl@postgres:5432/mmtl?sslmode=disable
       # After migration, change this to /data/disabled-sqlite-migration.db to disable the SQLite migration source.
-      MEDIASTATION_DATABASE_DB_PATH: /data/mediastation.db
-      MEDIASTATION_CACHE_CACHE_DIR: /cache
+      MMTL_DATABASE_DB_PATH: /data/mmtl.db
+      MMTL_CACHE_CACHE_DIR: /cache
 
       # Use /media and /downloads in the web UI and downloader by default.
-      # Only set MEDIASTATION_*_DIR to real host paths when migrating old
+      # Only set MMTL_*_DIR to real host paths when migrating old
       # libraries/tasks that already stored host paths.
-      MEDIASTATION_MEDIA_DIR: /media
-      MEDIASTATION_MEDIA_CONTAINER_DIR: /media
-      MEDIASTATION_DOWNLOAD_DIR: /downloads
-      MEDIASTATION_DOWNLOAD_CONTAINER_DIR: /downloads
+      MMTL_MEDIA_DIR: /media
+      MMTL_MEDIA_CONTAINER_DIR: /media
+      MMTL_DOWNLOAD_DIR: /downloads
+      MMTL_DOWNLOAD_CONTAINER_DIR: /downloads
 
   postgres:
     image: postgres:16-alpine
     restart: unless-stopped
     environment:
-      POSTGRES_DB: mediastation
-      POSTGRES_USER: mediastation
-      POSTGRES_PASSWORD: mediastation
+      POSTGRES_DB: mmtl
+      POSTGRES_USER: mmtl
+      POSTGRES_PASSWORD: mmtl
     volumes:
       - ./postgres:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mediastation -d mediastation"]
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mmtl -d mmtl"]
       interval: 10s
       timeout: 5s
       retries: 10
@@ -386,7 +386,7 @@ services:
 4. **Use external players**
    - Add the server as an Emby/Jellyfin-compatible server.
    - Server URL: `http://SERVER_IP:18080`.
-   - Use the username and password created in MediaStationGo. No separate Emby server is required.
+   - Use the username and password created in MMTL. No separate Emby server is required.
    - Admins can create regular users in the web UI or Bot so each person can log in with their own account.
 
 5. **Use cloud playback**
@@ -401,21 +401,21 @@ services:
 ### Update
 
 ```bash
-docker compose pull mediastation-go
-docker compose up -d --no-deps mediastation-go
+docker compose pull mmtl
+docker compose up -d --no-deps mmtl
 ```
 
 ### Logs
 
 ```bash
-docker compose logs -f mediastation-go
+docker compose logs -f mmtl
 tail -f ./data/logs/app.log
 tail -f ./data/logs/error.log
 ```
 
-The compose templates keep full application logs in `./data/logs/app.log` and split warnings/errors into `warn.log` and `error.log`. Keep `MEDIASTATION_LOGGING_LEVEL=info` while diagnosing subscription, site search, organizer, or STRM generation issues; temporarily switch to `debug` only when deeper tracing is needed.
+The compose templates keep full application logs in `./data/logs/app.log` and split warnings/errors into `warn.log` and `error.log`. Keep `MMTL_LOGGING_LEVEL=info` while diagnosing subscription, site search, organizer, or STRM generation issues; temporarily switch to `debug` only when deeper tracing is needed.
 
-Use a writable container path for STRM output, such as `/data/strm` or a mounted media path. Deployments that previously saved `/app/data/strm` are migrated automatically to the configured `MEDIASTATION_APP_DATA_DIR`, which defaults to `/data`.
+Use a writable container path for STRM output, such as `/data/strm` or a mounted media path. Deployments that previously saved `/app/data/strm` are migrated automatically to the configured `MMTL_APP_DATA_DIR`, which defaults to `/data`.
 
 ### Backup
 
@@ -435,7 +435,7 @@ redis/        # hot cache, safe to rebuild
 opensearch/   # search index, rebuildable; backing it up can save reindex time on huge libraries
 ```
 
-`cache/` is usually not important. If you explicitly still use `database.type=sqlite`, the primary database remains `data/mediastation.db`.
+`cache/` is usually not important. If you explicitly still use `database.type=sqlite`, the primary database remains `data/mmtl.db`.
 
 ### Stop
 
@@ -453,7 +453,7 @@ Check the container:
 
 ```bash
 docker ps
-docker compose logs --tail=100 mediastation-go
+docker compose logs --tail=100 mmtl
 ```
 
 Then open:
@@ -503,7 +503,7 @@ Beginners should not. Editing `docker-compose.yml` directly is easier to underst
 | Libraries | Movies, TV shows, anime, variety, music, adult content |
 | Metadata | NFO, local artwork, TMDb, TheTVDB, Bangumi, Douban, Fanart, JavBus/JavDB |
 | Playback | Web playback, HTTP Range, HLS transcoding, direct links, STRMURL, 302 redirect |
-| External clients | Emby-protocol compatible APIs; MediaStationGo accounts can log in to third-party players |
+| External clients | Emby-protocol compatible APIs; MMTL accounts can log in to third-party players |
 | User management | Multi-user accounts, admin/regular users, expiry dates, device management, Bot registration and redeem codes |
 | Downloads | qBittorrent, site search, subscriptions, post-download organization |
 | File manager | Browse, organize, copy, move, hardlink, symlink |
@@ -543,7 +543,7 @@ cd web && npm run build
 
 ## Community and Friends
 
-- Telegram group: <https://t.me/MediaStationGo>
+- Telegram group: <https://t.me/MMTL>
 - NodeSeek: [https://www.nodeseek.com/](https://www.nodeseek.com/)
 - LINUX DO: [https://linux.do/](https://linux.do/)
 
@@ -551,7 +551,7 @@ cd web && npm run build
 
 ## Donation
 
-If MediaStationGo saves you time, feel free to buy the author a bowl of noodles.
+If MMTL saves you time, feel free to buy the author a bowl of noodles.
 
 <img width="200" height="200" alt="WeChat Donation QR" src="https://github.com/user-attachments/assets/d6077de5-8305-400d-8b82-470ef05d926e" />
 
@@ -559,11 +559,11 @@ If MediaStationGo saves you time, feel free to buy the author a bowl of noodles.
 
 ## Star History
 
-<a href="https://www.star-history.com/?repos=ShukeBta%2FMediaStationGo&type=date&legend=top-left">
+<a href="https://www.star-history.com/?repos=ShukeBta%2FMMTL&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ShukeBta/MediaStationGo&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=ShukeBta/MediaStationGo&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=ShukeBta/MediaStationGo&type=date&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ShukeBta/MMTL&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=ShukeBta/MMTL&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=ShukeBta/MMTL&type=date&legend=top-left" />
  </picture>
 </a>
 

SECURITY.md

@@ -1,13 +1,13 @@
 # 安全策略
 
-MediaStationGo 是自托管媒体系统，常部署在 NAS、家庭网络、Docker、反向代理和第三方下载器环境中。安全问题通常会同时涉及应用代码、容器配置、路径映射、站点 Cookie / API Key、下载器凭据和外部访问入口。请按本策略报告和处理安全问题。
+MMTL 是自托管媒体系统，常部署在 NAS、家庭网络、Docker、反向代理和第三方下载器环境中。安全问题通常会同时涉及应用代码、容器配置、路径映射、站点 Cookie / API Key、下载器凭据和外部访问入口。请按本策略报告和处理安全问题。
 
 ## 支持范围
 
 我们优先支持以下版本和部署方式的安全修复：
 
 - 当前 `main` 分支。
-- 最新发布镜像：`ghcr.io/shukebta/mediastation-go:latest`。
+- 最新发布镜像：`ghcr.io/shukebta/mmtl:latest`。
 - README 中推荐的 Docker Compose 第一档、第二档、第三档部署方式。
 
 历史版本、私有魔改镜像、未公开补丁分支和非标准部署仍可报告，但维护者可能要求先在最新 `main` 或最新镜像中复现。
@@ -16,7 +16,7 @@ MediaStationGo 是自托管媒体系统，常部署在 NAS、家庭网络、Dock
 
 请不要在公开 Issue、PR、讨论区或群聊中披露可利用细节。优先使用 GitHub Security Advisory 私密报告：
 
-<https://github.com/ShukeBta/MediaStationGo/security/advisories/new>
+<https://github.com/ShukeBta/MMTL/security/advisories/new>
 
 如果无法使用 GitHub 私密报告，可以先通过项目 README 中的社区入口联系维护者，说明“需要私下报告安全问题”，不要直接贴出利用细节、密钥或完整日志。
 
@@ -68,14 +68,14 @@ MediaStationGo 是自托管媒体系统，常部署在 NAS、家庭网络、Dock
 
 ## 自托管安全基线
 
-部署 MediaStationGo 时建议：
+部署 MMTL 时建议：
 
 - 首次登录后立即修改默认 `admin / admin123`。
 - 不要把 PostgreSQL、Redis、OpenSearch、qBittorrent WebUI 暴露到公网。
 - 反向代理公网访问时启用 HTTPS，并限制管理后台访问来源。
 - 使用强随机的 JWT / 加密密钥，妥善备份 `./data` 和数据库。
 - 不要在 Issue、PR、截图或日志中公开站点 Cookie、API Key、Passkey、下载器密码。
-- Docker `volumes` 只挂载 MediaStationGo 需要访问的目录，媒体库目录需要写入时再授予写权限。
+- Docker `volumes` 只挂载 MMTL 需要访问的目录，媒体库目录需要写入时再授予写权限。
 - 定期更新镜像，并在升级前备份 `./postgres` 和 `./data`。
 
 ## 安全修复 PR

VERSION

@@ -1 +1 @@
-0.0.9
+0.0.57

cmd/server/log_rotate.go

@@ -7,7 +7,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MMTL/internal/config"
 )
 
 const defaultLogMaxSizeMB = 20

cmd/server/logging.go

@@ -8,7 +8,7 @@ import (
 	"go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MMTL/internal/config"
 )
 
 // newLogger 根据 cfg.Logging 构建 Zap。

cmd/server/logging_test.go

@@ -8,7 +8,7 @@ import (
 
 	"go.uber.org/zap"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MMTL/internal/config"
 )
 
 func TestProductionLoggerWritesConfiguredInfoToAppLogAndSplitsWarnError(t *testing.T) {

cmd/server/main.go

@@ -1,6 +1,6 @@
-// Package main is the MediaStationGo HTTP server entry point.
+// Package main is the MMTL HTTP server entry point.
 //
-// MediaStationGo is a Go rewrite of the legacy Python implementation,
+// MMTL is a Go rewrite of the legacy Python implementation,
 // adopting the same tech stack as cropflre/nowen-video:
 //
 //	Backend:  Go 1.25 + Gin + GORM + PostgreSQL/SQLite + Viper + Zap + JWT
@@ -12,10 +12,7 @@ package main
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"net"
-	"net/http"
 	"os"
 	"os/signal"
 	"strings"
@@ -24,10 +21,10 @@ import (
 
 	"go.uber.org/zap"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/database"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/database"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // version is overwritten at build time via -ldflags="-X main.version=...".
@@ -38,7 +35,7 @@ func effectiveVersion(buildVersion string) string {
 	if buildVersion != "" && buildVersion != "dev" {
 		return buildVersion
 	}
-	if envVersion := strings.TrimSpace(os.Getenv("MEDIASTATION_VERSION")); envVersion != "" {
+	if envVersion := strings.TrimSpace(os.Getenv("MMTL_VERSION")); envVersion != "" {
 		return envVersion
 	}
 	if buildVersion == "" {
@@ -108,30 +105,19 @@ func main() {
 
 	router := buildRouter(cfg, logger, services)
 
-	srv := &http.Server{
-		Addr:              fmt.Sprintf(":%d", cfg.App.Port),
-		Handler:           router,
-		ReadHeaderTimeout: 15 * time.Second,
+	serverMgr := newServerManager(cfg, logger, router)
+	services.ReloadHTTPServer = serverMgr.Reload
+	if err := serverMgr.Start(); err != nil {
+		logger.Fatal("listen failed", zap.Error(err))
 	}
-
-	ln, err := net.Listen("tcp", srv.Addr)
-	if err != nil {
-		logger.Fatal("listen failed", zap.String("addr", srv.Addr), zap.Error(err))
-	}
-	localIP := getLocalIP()
-	logger.Info("server is ready",
-		zap.String("local", fmt.Sprintf("http://%s:%d", localIP, cfg.App.Port)),
-		zap.String("listen", srv.Addr),
-	)
 	go func() {
-		if err := srv.Serve(ln); err != nil && !errors.Is(err, http.ErrServerClosed) {
-			logger.Fatal("listen failed", zap.Error(err))
+		scheme := "http"
+		if cfg.App.HTTPSEnabled {
+			scheme = "https"
 		}
-	}()
-	go func() {
 		if publicIP := getPublicIP(3 * time.Second); publicIP != "" {
 			logger.Info("server public endpoint",
-				zap.String("public", fmt.Sprintf("http://%s:%d", publicIP, cfg.App.Port)),
+				zap.String("public", fmt.Sprintf("%s://%s:%d", scheme, publicIP, cfg.App.Port)),
 			)
 		}
 	}()
@@ -145,7 +131,7 @@ func main() {
 
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
-	if err := srv.Shutdown(ctx); err != nil {
+	if err := serverMgr.Shutdown(ctx); err != nil {
 		logger.Error("graceful shutdown failed", zap.Error(err))
 	}
 	services.Close()

cmd/server/main_test.go

@@ -12,23 +12,23 @@ import (
 )
 
 func TestEffectiveVersionPrefersBuildVersion(t *testing.T) {
-	t.Setenv("MEDIASTATION_VERSION", "MediaStationGo-v0.1.15")
+	t.Setenv("MMTL_VERSION", "MMTL-v0.1.15")
 
-	if got := effectiveVersion("MediaStationGo-v0.1.16"); got != "MediaStationGo-v0.1.16" {
-		t.Fatalf("effectiveVersion = %q, want MediaStationGo-v0.1.16", got)
+	if got := effectiveVersion("MMTL-v0.1.16"); got != "MMTL-v0.1.16" {
+		t.Fatalf("effectiveVersion = %q, want MMTL-v0.1.16", got)
 	}
 }
 
 func TestEffectiveVersionUsesEnvWhenBuildVersionIsDev(t *testing.T) {
-	t.Setenv("MEDIASTATION_VERSION", " MediaStationGo-v0.1.16 ")
+	t.Setenv("MMTL_VERSION", " MMTL-v0.1.16 ")
 
-	if got := effectiveVersion("dev"); got != "MediaStationGo-v0.1.16" {
-		t.Fatalf("effectiveVersion = %q, want MediaStationGo-v0.1.16", got)
+	if got := effectiveVersion("dev"); got != "MMTL-v0.1.16" {
+		t.Fatalf("effectiveVersion = %q, want MMTL-v0.1.16", got)
 	}
 }
 
 func TestEffectiveVersionDefaultsToDev(t *testing.T) {
-	t.Setenv("MEDIASTATION_VERSION", "")
+	t.Setenv("MMTL_VERSION", "")
 
 	if got := effectiveVersion(""); got != "dev" {
 		t.Fatalf("effectiveVersion = %q, want dev", got)
@@ -52,7 +52,7 @@ func TestServeSPANoCachesIndexAndServesRoutes(t *testing.T) {
 	}
 
 	router := gin.New()
-	serveSPA(router, webDir)
+	serveSPA(router, os.DirFS(webDir))
 
 	for _, path := range []string{"/", "/login", "/library/e1c3507e-2878-40ae-a0e1-6b6e44b7fa7a", "/media/abc"} {
 		req := httptest.NewRequest(http.MethodGet, path, nil)
@@ -85,7 +85,7 @@ func TestServeSPAServesAssetsImmutableAndBypassesAPIRoutes(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(webDir, "assets", "app.js"), []byte("console.log('ok')"), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(webDir, "brand", "mediastationgo-logo.svg"), []byte("<svg></svg>"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(webDir, "brand", "mmtl-logo.svg"), []byte("<svg></svg>"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(webDir, "artwork-cache-sw.js"), []byte("self.addEventListener('fetch', () => {})"), 0o644); err != nil {
@@ -93,7 +93,7 @@ func TestServeSPAServesAssetsImmutableAndBypassesAPIRoutes(t *testing.T) {
 	}
 
 	router := gin.New()
-	serveSPA(router, webDir)
+	serveSPA(router, os.DirFS(webDir))
 
 	assetReq := httptest.NewRequest(http.MethodGet, "/assets/app.js", nil)
 	assetResp := httptest.NewRecorder()
@@ -105,7 +105,7 @@ func TestServeSPAServesAssetsImmutableAndBypassesAPIRoutes(t *testing.T) {
 		t.Fatalf("asset Cache-Control = %q, want immutable", got)
 	}
 
-	brandReq := httptest.NewRequest(http.MethodGet, "/brand/mediastationgo-logo.svg", nil)
+	brandReq := httptest.NewRequest(http.MethodGet, "/brand/mmtl-logo.svg", nil)
 	brandResp := httptest.NewRecorder()
 	router.ServeHTTP(brandResp, brandReq)
 	if brandResp.Code != http.StatusOK {
@@ -155,7 +155,7 @@ func TestServeSPAServesAssetsImmutableAndBypassesAPIRoutes(t *testing.T) {
 func TestServeSPAMissingIndexReportsExplicit404(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	router := gin.New()
-	serveSPA(router, t.TempDir())
+	serveSPA(router, os.DirFS(t.TempDir()))
 
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	w := httptest.NewRecorder()

cmd/server/router.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"io/fs"
+	"mime"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -9,10 +11,12 @@ import (
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/handler"
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/handler"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/service"
+
+	"github.com/ShukeBta/MMTL/web"
 )
 
 func buildRouter(cfg *config.Config, logger *zap.Logger, svc *service.Container) *gin.Engine {
@@ -29,31 +33,41 @@ func buildRouter(cfg *config.Config, logger *zap.Logger, svc *service.Container)
 
 	handler.Register(r, cfg, logger, svc)
 
-	if cfg.App.WebDir != "" {
-		serveSPA(r, cfg.App.WebDir)
+	// Prefer a directory on disk when configured explicitly (e.g. the Docker image
+	// mounts web/dist from the build stage, or an operator overrides app.web_dir
+	// with a custom skin). Otherwise fall back to the SPA embedded into the binary,
+	// which is what makes the cross-platform single-file artifacts work.
+	uiFS := webui.DistFS()
+	if dir := cfg.App.WebDir; dir != "" {
+		disk := os.DirFS(dir)
+		if index, err := fs.Stat(disk, "index.html"); err == nil && !index.IsDir() {
+			uiFS = disk
+		}
 	}
+	serveSPA(r, uiFS)
 	return r
 }
 
 // serveSPA serves the React build artifacts and falls back to index.html for
-// non-API, non-asset paths so client-side routing keeps working.
-func serveSPA(r *gin.Engine, webDir string) {
+// non-API, non-asset paths so client-side routing keeps working. The UI tree
+// comes from root, which is either the compiled-in SPA or an on-disk web dir.
+func serveSPA(r *gin.Engine, root fs.FS) {
 	assets := r.Group("/assets")
 	assets.Use(func(c *gin.Context) {
 		c.Header("Cache-Control", "public, max-age=31536000, immutable")
 		c.Next()
 	})
-	assets.Static("/", filepath.Join(webDir, "assets"))
+	assets.GET("/*filepath", serveFSDir(root, "assets"))
 	brand := r.Group("/brand")
 	brand.Use(func(c *gin.Context) {
 		setNoCacheHeaders(c)
 		c.Next()
 	})
-	brand.Static("/", filepath.Join(webDir, "brand"))
+	brand.GET("/*filepath", serveFSDir(root, "brand"))
 	for _, rootFile := range []string{"/favicon.ico", "/favicon.svg", "/artwork-cache-sw.js"} {
-		filePath := filepath.Join(webDir, strings.TrimPrefix(rootFile, "/"))
-		r.GET(rootFile, serveNoCacheFile(filePath))
-		r.HEAD(rootFile, serveNoCacheFile(filePath))
+		name := strings.TrimPrefix(rootFile, "/")
+		r.GET(rootFile, serveFSFile(root, name))
+		r.HEAD(rootFile, serveFSFile(root, name))
 	}
 	r.NoRoute(func(c *gin.Context) {
 		path := c.Request.URL.Path
@@ -61,28 +75,50 @@ func serveSPA(r *gin.Engine, webDir string) {
 			c.Status(http.StatusNotFound)
 			return
 		}
-		serveSPAIndex(c, filepath.Join(webDir, "index.html"))
+		setNoCacheHeaders(c)
+		data, err := fs.ReadFile(root, "index.html")
+		if err != nil {
+			c.String(http.StatusNotFound, "MMTL web UI not found")
+			return
+		}
+		c.Data(http.StatusOK, "text/html; charset=utf-8", data)
 	})
 }
 
-func serveNoCacheFile(filePath string) gin.HandlerFunc {
+// serveFSDir serves a static subdirectory of root. A missing asset returns 404.
+func serveFSDir(root fs.FS, dir string) gin.HandlerFunc {
+	sub, err := fs.Sub(root, dir)
+	if err != nil {
+		return func(c *gin.Context) { c.Status(http.StatusNotFound) }
+	}
+	handler := http.StripPrefix("/"+dir, http.FileServerFS(sub))
 	return func(c *gin.Context) {
-		setNoCacheHeaders(c)
-		if _, err := os.Stat(filePath); err != nil {
-			c.Status(http.StatusNotFound)
-			return
-		}
-		c.File(filePath)
+		handler.ServeHTTP(c.Writer, c.Request)
 	}
 }
 
-func serveSPAIndex(c *gin.Context, indexPath string) {
-	setNoCacheHeaders(c)
-	if _, err := os.Stat(indexPath); err != nil {
-		c.String(http.StatusNotFound, "MediaStationGo web UI not found: %s", indexPath)
-		return
+// serveFSFile serves a single root-level file (favicon / service worker) with
+// no-cache headers. It reads from root, which may be the embedded SPA or disk.
+func serveFSFile(root fs.FS, name string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		setNoCacheHeaders(c)
+		data, err := fs.ReadFile(root, name)
+		if err != nil {
+			c.Status(http.StatusNotFound)
+			return
+		}
+		c.Data(http.StatusOK, mimeTypeByName(name), data)
+	}
+}
+
+// mimeTypeByName returns an HTTP content type guessed from a file extension.
+func mimeTypeByName(name string) string {
+	switch mime.TypeByExtension(filepath.Ext(name)) {
+	case "":
+		return "application/octet-stream"
+	default:
+		return mime.TypeByExtension(filepath.Ext(name))
 	}
-	c.File(indexPath)
 }
 
 func setNoCacheHeaders(c *gin.Context) {

cmd/server/server_manager.go

@@ -0,0 +1,267 @@
+package main
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/service"
+)
+
+// tlsPair 记录当前正在服务的证书，用于判断是否需要重新绑定监听。
+type tlsPair struct {
+	cert    tls.Certificate
+	certPEM string
+	keyPEM  string
+	// version 是解析后的证书/私钥指纹；内容或磁盘文件变化都会导致其改变，
+	// 据此决定是否需要重新绑定监听。
+	version string
+}
+
+// serverManager 负责 MMTL 的 HTTP/HTTPS 监听。HTTPS 设置保存后调用 Reload，
+// 在同一个端口上把明文 HTTP 与 TLS 监听热切换，无需重启进程：
+//
+//   - 关闭旧监听释放端口（同一进程内 Windows 不允许重复绑定同一端口）；
+//   - 按最新配置重新绑定并立即对外服务；
+//   - 旧服务器随后优雅退出，正在进行的播放/请求不会被立刻掐断。
+//
+// 任何校验失败都会中止切换并保留旧监听，保证用户不会被锁在服务外面。
+type serverManager struct {
+	cfg     *config.Config
+	log     *zap.Logger
+	handler http.Handler
+	addr    string
+
+	mu                sync.Mutex
+	srv               *http.Server
+	ln                net.Listener
+	pair              *tlsPair
+	stopCh            chan struct{}
+	autoReloadStarted bool
+}
+
+func newServerManager(cfg *config.Config, log *zap.Logger, handler http.Handler) *serverManager {
+	return &serverManager{
+		cfg:     cfg,
+		log:     log,
+		handler: handler,
+		addr:    fmt.Sprintf(":%d", cfg.App.Port),
+		stopCh:  make(chan struct{}),
+	}
+}
+
+// Start 启动监听。即使 HTTPS 配置损坏也退回明文 HTTP 继续启动，避免服务冷启动失败。
+func (m *serverManager) Start() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	pair, err := m.desiredPair()
+	if err != nil {
+		m.log.Error("invalid HTTPS config at startup, serving plain HTTP instead", zap.Error(err))
+		pair = nil
+	}
+	if err := m.bind(pair); err != nil {
+		return err
+	}
+	m.logServerReady()
+	m.maybeStartAutoReloadLocked()
+	return nil
+}
+
+// Reload 依据最新配置热切换监听。返回的错误会带给调用它的设置接口；若新监听
+// 绑定失败会自动回滚到旧配置继续服务。
+func (m *serverManager) Reload() error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	pair, err := m.desiredPair()
+	if err != nil {
+		m.log.Error("server reload aborted", zap.Error(err))
+		return err
+	}
+	if m.pairEquals(pair) {
+		return nil
+	}
+
+	oldSrv, oldLn, oldPair := m.srv, m.ln, m.pair
+	if oldLn != nil {
+		_ = oldLn.Close() // 释放端口后再绑定新监听
+	}
+	m.srv, m.ln, m.pair = nil, nil, nil
+
+	firstErr := m.bind(pair)
+	if firstErr != nil {
+		m.log.Error("bind new listener failed, rolling back to previous", zap.Error(firstErr))
+		if rbErr := m.bind(oldPair); rbErr != nil {
+			return fmt.Errorf("reload failed: %v; rollback failed: %v", firstErr, rbErr)
+		}
+	}
+	// 新监听已就绪，让旧服务器在新连接切换到新监听后优雅退出。
+	m.drain(oldSrv)
+	m.logServerReady()
+	m.maybeStartAutoReloadLocked()
+	return firstErr
+}
+
+// Shutdown 优雅停止当前服务器（用于进程退出）。
+func (m *serverManager) Shutdown(ctx context.Context) error {
+	select {
+	case <-m.stopCh:
+	default:
+		close(m.stopCh)
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.srv == nil {
+		return nil
+	}
+	return m.srv.Shutdown(ctx)
+}
+
+// desiredPair 根据当前配置计算目标监听形态：nil 表示明文 HTTP，非 nil 表示 TLS。
+// 证书/私钥按"路径优先、内容兜底"解析，并校验是否匹配。
+func (m *serverManager) desiredPair() (*tlsPair, error) {
+	if m.cfg == nil || !m.cfg.App.HTTPSEnabled {
+		return nil, nil
+	}
+	certPEM, err := service.ResolveSSLMaterial(m.cfg.App.SSLCert, m.cfg.App.SSLCertPath, "证书")
+	if err != nil {
+		return nil, err
+	}
+	keyPEM, err := service.ResolveSSLMaterial(m.cfg.App.SSLKey, m.cfg.App.SSLKeyPath, "私钥")
+	if err != nil {
+		return nil, err
+	}
+	if err := service.ValidateSSLKeyPair(certPEM, keyPEM); err != nil {
+		return nil, err
+	}
+	cert, err := tls.X509KeyPair([]byte(certPEM), []byte(keyPEM))
+	if err != nil {
+		return nil, fmt.Errorf("SSL 证书/私钥无效：%v", err)
+	}
+	return &tlsPair{
+		cert:    cert,
+		certPEM: certPEM,
+		keyPEM:  keyPEM,
+		version: certPEM + "\x00" + keyPEM,
+	}, nil
+}
+
+// maybeStartAutoReloadLocked 在证书/私钥通过文件路径配置时，幂等地启动后台轮询，
+// 便于运行中切换到路径方式（或换证）后无需重启也能热更新。调用方需持有 m.mu。
+func (m *serverManager) maybeStartAutoReloadLocked() {
+	if m.autoReloadStarted {
+		return
+	}
+	if !m.pathBased() {
+		return
+	}
+	m.autoReloadStarted = true
+	m.startAutoReload()
+}
+
+// pathBased 是否至少有一侧证书/私钥通过文件路径配置。
+func (m *serverManager) pathBased() bool {
+	return strings.TrimSpace(m.cfg.App.SSLCertPath) != "" || strings.TrimSpace(m.cfg.App.SSLKeyPath) != ""
+}
+
+// startAutoReload 后台轮询文件变更并自动热更新，方便换证。
+func (m *serverManager) startAutoReload() {
+	ticker := time.NewTicker(30 * time.Second)
+	go func() {
+		defer ticker.Stop()
+		for {
+			select {
+			case <-m.stopCh:
+				return
+			case <-ticker.C:
+				if !m.pathBased() {
+					continue // 路径已清空（改回内容配置），不再轮询
+				}
+				if err := m.Reload(); err != nil {
+					m.log.Warn("periodic https reload failed", zap.Error(err))
+				}
+			}
+		}
+	}()
+}
+
+// pairEquals 判断目标配置与当前监听是否一致，一致则无需重新绑定。
+func (m *serverManager) pairEquals(pair *tlsPair) bool {
+	if pair == nil && m.pair == nil {
+		return true
+	}
+	if pair == nil || m.pair == nil {
+		return false
+	}
+	return pair.version == m.pair.version
+}
+
+// bind 创建并按需启用 TLS 的监听，异步开始服务。
+func (m *serverManager) bind(pair *tlsPair) error {
+	ln, err := net.Listen("tcp", m.addr)
+	if err != nil {
+		return fmt.Errorf("listen %s: %w", m.addr, err)
+	}
+	srv := &http.Server{
+		Handler:           m.handler,
+		ReadHeaderTimeout: 15 * time.Second,
+	}
+	if pair != nil {
+		ln = tls.NewListener(ln, &tls.Config{
+			Certificates: []tls.Certificate{pair.cert},
+			MinVersion:   tls.VersionTLS12,
+		})
+	}
+	m.srv, m.ln, m.pair = srv, ln, pair
+	go m.serve(srv, ln)
+	return nil
+}
+
+func (m *serverManager) serve(s *http.Server, ln net.Listener) {
+	if err := s.Serve(ln); err != nil &&
+		!errors.Is(err, http.ErrServerClosed) && !errors.Is(err, net.ErrClosed) {
+		m.log.Fatal("listen failed", zap.Error(err))
+	}
+}
+
+// drain 让旧服务器在后台优雅退出（等待进行中的连接完成或在超时后强制关闭）。
+func (m *serverManager) drain(s *http.Server) {
+	if s == nil {
+		return
+	}
+	go func(s *http.Server) {
+		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		if err := s.Shutdown(ctx); err != nil && !errors.Is(err, context.DeadlineExceeded) {
+			m.log.Warn("drain old server failed", zap.Error(err))
+		}
+	}(s)
+}
+
+func (m *serverManager) logServerReady() {
+	scheme := "http"
+	if m.pair != nil {
+		scheme = "https"
+	}
+	localIP := getLocalIP()
+	m.log.Info("server is ready",
+		zap.String("scheme", scheme),
+		zap.String("local", fmt.Sprintf("%s://%s:%d", scheme, localIP, m.cfg.App.Port)),
+		zap.String("listen", m.addr),
+	)
+	if m.pair != nil {
+		m.log.Info("HTTPS is enabled; plain HTTP is no longer served on this port",
+			zap.String("addr", m.addr),
+		)
+	}
+}

cmd/server/server_manager_test.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/ShukeBta/MMTL/internal/config"
+)
+
+func makeTestPairPEM(t *testing.T) (certPEM, keyPEM string) {
+	t.Helper()
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "localhost"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		DNSNames:     []string{"localhost"},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &priv.PublicKey, priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyDER, err := x509.MarshalECPrivateKey(priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certPEM = strings.TrimSpace(string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})))
+	keyPEM = strings.TrimSpace(string(pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})))
+	return certPEM, keyPEM
+}
+
+func newTestServerManager(t *testing.T) *serverManager {
+	t.Helper()
+	cfg := &config.Config{}
+	cfg.App.Port = 18081
+	return newServerManager(cfg, zap.NewNop(), http.NewServeMux())
+}
+
+func TestDesiredPairModes(t *testing.T) {
+	m := newTestServerManager(t)
+
+	if p, err := m.desiredPair(); err != nil || p != nil {
+		t.Fatalf("disabled should be nil pair, got p=%v err=%v", p, err)
+	}
+
+	certPEM, keyPEM := makeTestPairPEM(t)
+	m.cfg.App.HTTPSEnabled = true
+	m.cfg.App.SSLCert, m.cfg.App.SSLKey = certPEM, keyPEM
+	p, err := m.desiredPair()
+	if err != nil || p == nil || p.version == "" {
+		t.Fatalf("content pair failed: p=%v err=%v", p, err)
+	}
+
+	dir := t.TempDir()
+	certPath, keyPath := filepath.Join(dir, "cert.pem"), filepath.Join(dir, "key.pem")
+	if err := os.WriteFile(certPath, []byte(certPEM), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(keyPath, []byte(keyPEM), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	m.cfg.App.SSLCert, m.cfg.App.SSLKey = "", ""
+	m.cfg.App.SSLCertPath, m.cfg.App.SSLKeyPath = certPath, keyPath
+	p2, err := m.desiredPair()
+	if err != nil || p2 == nil {
+		t.Fatalf("path pair failed: %v", err)
+	}
+
+	m.cfg.App.SSLKeyPath = filepath.Join(dir, "nope.pem")
+	if _, err := m.desiredPair(); err == nil {
+		t.Fatal("expected error when key file missing")
+	}
+	m.cfg.App.SSLKeyPath = keyPath
+
+	// 替换文件（换一套新的有效证书）后版本号应变化，触发热更新。
+	newCert, newKey := makeTestPairPEM(t)
+	if err := os.WriteFile(certPath, []byte(newCert), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(keyPath, []byte(newKey), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	p3, err := m.desiredPair()
+	if err != nil {
+		t.Fatalf("replace: %v", err)
+	}
+	if p3.version == p2.version {
+		t.Fatal("version should change after files replaced")
+	}
+}

cmd/server/startup.go

@@ -8,7 +8,7 @@ import (
 
 	"go.uber.org/zap"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MMTL/internal/config"
 )
 
 func applyCPUThreadLimit(cfg *config.Config, logger *zap.Logger) {

docker-compose.search.yml

@@ -1,7 +1,7 @@
-# MediaStationGo 第三档完整 Docker Compose 部署文件
+# MMTL 第三档完整 Docker Compose 部署文件
 #
 # 组件：
-#   MediaStationGo + PostgreSQL + Redis + OpenSearch
+#   MMTL + PostgreSQL + Redis + OpenSearch
 #
 # 使用方式二选一：
 #   1. 保存为 docker-compose.yml 后执行：
@@ -19,12 +19,12 @@
 #   admin / admin123
 
 services:
-  mediastation-go:
+  mmtl:
     # 镜像二选一：
     # 方式一：GitHub 仓库镜像 GHCR（默认，推荐）
-    image: ghcr.io/shukebta/mediastation-go:latest
+    image: ghcr.io/shukebta/mmtl:latest
     # 方式二：Docker Hub 备用（GHCR 拉取慢或不可用时使用）
-    # image: shukbet/mediastationgo:latest
+    # image: shukbet/mmtl:latest
 
     restart: unless-stopped
     init: true
@@ -78,45 +78,45 @@ services:
       PUID: "1000"
       PGID: "1000"
 
-      MEDIASTATION_APP_HOST: 0.0.0.0
-      MEDIASTATION_APP_PORT: 8080
-      MEDIASTATION_APP_WEB_DIR: /app/web/dist
-      MEDIASTATION_APP_DATA_DIR: /data
-      MEDIASTATION_LOGGING_LEVEL: info
-      MEDIASTATION_LOGGING_FORMAT: console
-      MEDIASTATION_LOGGING_OUTPUT_PATH: /data/logs
-      MEDIASTATION_LOGGING_MAX_SIZE_MB: "50"
-      MEDIASTATION_LOGGING_MAX_BACKUPS: "20"
-      MEDIASTATION_LOGGING_MAX_AGE_DAYS: "30"
+      MMTL_APP_HOST: 0.0.0.0
+      MMTL_APP_PORT: 8080
+      MMTL_APP_WEB_DIR: /app/web/dist
+      MMTL_APP_DATA_DIR: /data
+      MMTL_LOGGING_LEVEL: info
+      MMTL_LOGGING_FORMAT: console
+      MMTL_LOGGING_OUTPUT_PATH: /data/logs
+      MMTL_LOGGING_MAX_SIZE_MB: "50"
+      MMTL_LOGGING_MAX_BACKUPS: "20"
+      MMTL_LOGGING_MAX_AGE_DAYS: "30"
 
-      MEDIASTATION_DATABASE_TYPE: postgres
-      MEDIASTATION_DATABASE_DSN: postgres://mediastation:mediastation@postgres:5432/mediastation?sslmode=disable
-      MEDIASTATION_DATABASE_DB_PATH: /data/mediastation.db
+      MMTL_DATABASE_TYPE: postgres
+      MMTL_DATABASE_DSN: postgres://mmtl:mmtl@postgres:5432/mmtl?sslmode=disable
+      MMTL_DATABASE_DB_PATH: /data/mmtl.db
 
-      MEDIASTATION_CACHE_REDIS_URL: redis://redis:6379/0
-      MEDIASTATION_CACHE_CACHE_DIR: /cache
+      MMTL_CACHE_REDIS_URL: redis://redis:6379/0
+      MMTL_CACHE_CACHE_DIR: /cache
 
       # OpenSearch 只做搜索索引，主数据仍以 PostgreSQL 为准。
-      MEDIASTATION_SEARCH_BACKEND: opensearch
-      MEDIASTATION_SEARCH_OPENSEARCH_URL: http://opensearch:9200
-      MEDIASTATION_SEARCH_INDEX: mediastation_media
+      MMTL_SEARCH_BACKEND: opensearch
+      MMTL_SEARCH_OPENSEARCH_URL: http://opensearch:9200
+      MMTL_SEARCH_INDEX: mmtl_media
 
-      MEDIASTATION_UPDATE_IMAGE: ghcr.io/shukebta/mediastation-go:latest
+      MMTL_UPDATE_IMAGE: ghcr.io/shukebta/mmtl:latest
 
       # 默认推荐在网页里使用容器路径 /media。
       # 如果旧媒体库已经保存了宿主机路径 /vol1/1000/Media，
       # 再把这里改成同一个宿主机真实路径用于旧路径换算。
-      MEDIASTATION_MEDIA_DIR: /media
-      MEDIASTATION_MEDIA_CONTAINER_DIR: /media
-      MEDIASTATION_DOWNLOAD_DIR: /downloads
-      MEDIASTATION_DOWNLOAD_CONTAINER_DIR: /downloads
+      MMTL_MEDIA_DIR: /media
+      MMTL_MEDIA_CONTAINER_DIR: /media
+      MMTL_DOWNLOAD_DIR: /downloads
+      MMTL_DOWNLOAD_CONTAINER_DIR: /downloads
 
-      MEDIASTATION_TRANSCODER_ENABLED: "true"
-      MEDIASTATION_TRANSCODER_HARDWARE_ACCEL: "false"
-      MEDIASTATION_TRANSCODER_REALTIME: "true"
-      MEDIASTATION_TRANSCODER_THREADS: "2"
-      MEDIASTATION_TRANSCODER_MAX_CONCURRENT: "1"
-      MEDIASTATION_TRANSCODER_IDLE_TIMEOUT_SECONDS: "120"
+      MMTL_TRANSCODER_ENABLED: "true"
+      MMTL_TRANSCODER_HARDWARE_ACCEL: "false"
+      MMTL_TRANSCODER_REALTIME: "true"
+      MMTL_TRANSCODER_THREADS: "2"
+      MMTL_TRANSCODER_MAX_CONCURRENT: "1"
+      MMTL_TRANSCODER_IDLE_TIMEOUT_SECONDS: "120"
 
     healthcheck:
       test: ["CMD-SHELL", "busybox wget -qO- http://127.0.0.1:8080/api/health || exit 1"]
@@ -133,18 +133,18 @@ services:
 
   postgres:
     image: postgres:16-alpine
-    # 首次部署允许拉取；日常更新请只 pull mediastation-go。
+    # 首次部署允许拉取；日常更新请只 pull mmtl。
     pull_policy: missing
     restart: unless-stopped
     environment:
-      POSTGRES_DB: mediastation
-      POSTGRES_USER: mediastation
-      POSTGRES_PASSWORD: mediastation
+      POSTGRES_DB: mmtl
+      POSTGRES_USER: mmtl
+      POSTGRES_PASSWORD: mmtl
       TZ: Asia/Shanghai
     volumes:
       - ./postgres:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mediastation -d mediastation"]
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mmtl -d mmtl"]
       interval: 10s
       timeout: 5s
       retries: 10

docker-compose.simple.yml

@@ -1,4 +1,4 @@
-# MediaStationGo 单镜像部署模板（SQLite）
+# MMTL 单镜像部署模板（SQLite）
 #
 # 适合：新手、单人使用、低配 NAS / 小主机。
 # 特点：只有一个镜像，不需要 PostgreSQL / Redis / .env。
@@ -12,12 +12,12 @@
 # 首次登录后请立刻修改密码。
 
 services:
-  mediastation-go:
-    image: ghcr.io/shukebta/mediastation-go:latest
+  mmtl:
+    image: ghcr.io/shukebta/mmtl:latest
     # Docker Hub 备用：
-    # image: shukbet/mediastationgo:latest
+    # image: shukbet/mmtl:latest
 
-    container_name: mediastation-go
+    container_name: mmtl
     restart: unless-stopped
     init: true
 
@@ -64,29 +64,29 @@ services:
       PUID: "1000"
       PGID: "1000"
 
-      MEDIASTATION_APP_HOST: 0.0.0.0
-      MEDIASTATION_APP_PORT: 8080
-      MEDIASTATION_APP_WEB_DIR: /app/web/dist
-      MEDIASTATION_APP_DATA_DIR: /data
+      MMTL_APP_HOST: 0.0.0.0
+      MMTL_APP_PORT: 8080
+      MMTL_APP_WEB_DIR: /app/web/dist
+      MMTL_APP_DATA_DIR: /data
 
-      # 单镜像档固定使用 SQLite。主数据库文件：./data/mediastation.db。
-      MEDIASTATION_DATABASE_TYPE: sqlite
-      MEDIASTATION_DATABASE_DB_PATH: /data/mediastation.db
-      MEDIASTATION_CACHE_CACHE_DIR: /cache
+      # 单镜像档固定使用 SQLite。主数据库文件：./data/mmtl.db。
+      MMTL_DATABASE_TYPE: sqlite
+      MMTL_DATABASE_DB_PATH: /data/mmtl.db
+      MMTL_CACHE_CACHE_DIR: /cache
 
       # 路径映射保持容器内统一，网页和下载器里优先使用 /media、/downloads。
-      MEDIASTATION_MEDIA_DIR: /media
-      MEDIASTATION_MEDIA_CONTAINER_DIR: /media
-      MEDIASTATION_DOWNLOAD_DIR: /downloads
-      MEDIASTATION_DOWNLOAD_CONTAINER_DIR: /downloads
+      MMTL_MEDIA_DIR: /media
+      MMTL_MEDIA_CONTAINER_DIR: /media
+      MMTL_DOWNLOAD_DIR: /downloads
+      MMTL_DOWNLOAD_CONTAINER_DIR: /downloads
 
       # 完整应用日志默认写入 ./data/logs/app.log；排查复杂问题时可临时改成 debug。
-      MEDIASTATION_LOGGING_LEVEL: info
-      MEDIASTATION_LOGGING_FORMAT: console
-      MEDIASTATION_LOGGING_OUTPUT_PATH: /data/logs
-      MEDIASTATION_LOGGING_MAX_SIZE_MB: "50"
-      MEDIASTATION_LOGGING_MAX_BACKUPS: "20"
-      MEDIASTATION_LOGGING_MAX_AGE_DAYS: "30"
+      MMTL_LOGGING_LEVEL: info
+      MMTL_LOGGING_FORMAT: console
+      MMTL_LOGGING_OUTPUT_PATH: /data/logs
+      MMTL_LOGGING_MAX_SIZE_MB: "50"
+      MMTL_LOGGING_MAX_BACKUPS: "20"
+      MMTL_LOGGING_MAX_AGE_DAYS: "30"
 
     extra_hosts:
       # 容器访问宿主机服务用，例如 qBittorrent: http://host.docker.internal:8085

docker-compose.standard.yml

@@ -1,7 +1,7 @@
-# MediaStationGo 第二档完整 Docker Compose 部署文件
+# MMTL 第二档完整 Docker Compose 部署文件
 #
 # 组件：
-#   MediaStationGo + PostgreSQL + Redis
+#   MMTL + PostgreSQL + Redis
 #
 # 使用方式二选一：
 #   1. 保存为 docker-compose.yml 后执行：
@@ -16,12 +16,12 @@
 #   admin / admin123
 
 services:
-  mediastation-go:
+  mmtl:
     # 镜像二选一：
     # 方式一：GitHub 仓库镜像 GHCR（默认，推荐）
-    image: ghcr.io/shukebta/mediastation-go:latest
+    image: ghcr.io/shukebta/mmtl:latest
     # 方式二：Docker Hub 备用（GHCR 拉取慢或不可用时使用）
-    # image: shukbet/mediastationgo:latest
+    # image: shukbet/mmtl:latest
 
     restart: unless-stopped
     init: true
@@ -73,39 +73,39 @@ services:
       PUID: "1000"
       PGID: "1000"
 
-      MEDIASTATION_APP_HOST: 0.0.0.0
-      MEDIASTATION_APP_PORT: 8080
-      MEDIASTATION_APP_WEB_DIR: /app/web/dist
-      MEDIASTATION_APP_DATA_DIR: /data
-      MEDIASTATION_LOGGING_LEVEL: info
-      MEDIASTATION_LOGGING_FORMAT: console
-      MEDIASTATION_LOGGING_OUTPUT_PATH: /data/logs
-      MEDIASTATION_LOGGING_MAX_SIZE_MB: "50"
-      MEDIASTATION_LOGGING_MAX_BACKUPS: "20"
-      MEDIASTATION_LOGGING_MAX_AGE_DAYS: "30"
+      MMTL_APP_HOST: 0.0.0.0
+      MMTL_APP_PORT: 8080
+      MMTL_APP_WEB_DIR: /app/web/dist
+      MMTL_APP_DATA_DIR: /data
+      MMTL_LOGGING_LEVEL: info
+      MMTL_LOGGING_FORMAT: console
+      MMTL_LOGGING_OUTPUT_PATH: /data/logs
+      MMTL_LOGGING_MAX_SIZE_MB: "50"
+      MMTL_LOGGING_MAX_BACKUPS: "20"
+      MMTL_LOGGING_MAX_AGE_DAYS: "30"
 
-      MEDIASTATION_DATABASE_TYPE: postgres
-      MEDIASTATION_DATABASE_DSN: postgres://mediastation:mediastation@postgres:5432/mediastation?sslmode=disable
-      MEDIASTATION_DATABASE_DB_PATH: /data/mediastation.db
+      MMTL_DATABASE_TYPE: postgres
+      MMTL_DATABASE_DSN: postgres://mmtl:mmtl@postgres:5432/mmtl?sslmode=disable
+      MMTL_DATABASE_DB_PATH: /data/mmtl.db
 
       # Redis 只做热缓存，源数据仍在 PostgreSQL；Redis 丢失可自动重建。
-      MEDIASTATION_CACHE_REDIS_URL: redis://redis:6379/0
-      MEDIASTATION_CACHE_CACHE_DIR: /cache
+      MMTL_CACHE_REDIS_URL: redis://redis:6379/0
+      MMTL_CACHE_CACHE_DIR: /cache
 
-      MEDIASTATION_UPDATE_IMAGE: ghcr.io/shukebta/mediastation-go:latest
+      MMTL_UPDATE_IMAGE: ghcr.io/shukebta/mmtl:latest
 
       # 路径换算配置。左边宿主机真实路径要和 volumes 左边保持一致。
-      MEDIASTATION_MEDIA_DIR: /media
-      MEDIASTATION_MEDIA_CONTAINER_DIR: /media
-      MEDIASTATION_DOWNLOAD_DIR: /downloads
-      MEDIASTATION_DOWNLOAD_CONTAINER_DIR: /downloads
+      MMTL_MEDIA_DIR: /media
+      MMTL_MEDIA_CONTAINER_DIR: /media
+      MMTL_DOWNLOAD_DIR: /downloads
+      MMTL_DOWNLOAD_CONTAINER_DIR: /downloads
 
-      MEDIASTATION_TRANSCODER_ENABLED: "true"
-      MEDIASTATION_TRANSCODER_HARDWARE_ACCEL: "false"
-      MEDIASTATION_TRANSCODER_REALTIME: "true"
-      MEDIASTATION_TRANSCODER_THREADS: "2"
-      MEDIASTATION_TRANSCODER_MAX_CONCURRENT: "1"
-      MEDIASTATION_TRANSCODER_IDLE_TIMEOUT_SECONDS: "120"
+      MMTL_TRANSCODER_ENABLED: "true"
+      MMTL_TRANSCODER_HARDWARE_ACCEL: "false"
+      MMTL_TRANSCODER_REALTIME: "true"
+      MMTL_TRANSCODER_THREADS: "2"
+      MMTL_TRANSCODER_MAX_CONCURRENT: "1"
+      MMTL_TRANSCODER_IDLE_TIMEOUT_SECONDS: "120"
 
     healthcheck:
       test: ["CMD-SHELL", "busybox wget -qO- http://127.0.0.1:8080/api/health || exit 1"]
@@ -122,18 +122,18 @@ services:
 
   postgres:
     image: postgres:16-alpine
-    # 首次部署允许拉取；日常更新请只 pull mediastation-go。
+    # 首次部署允许拉取；日常更新请只 pull mmtl。
     pull_policy: missing
     restart: unless-stopped
     environment:
-      POSTGRES_DB: mediastation
-      POSTGRES_USER: mediastation
-      POSTGRES_PASSWORD: mediastation
+      POSTGRES_DB: mmtl
+      POSTGRES_USER: mmtl
+      POSTGRES_PASSWORD: mmtl
       TZ: Asia/Shanghai
     volumes:
       - ./postgres:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mediastation -d mediastation"]
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mmtl -d mmtl"]
       interval: 10s
       timeout: 5s
       retries: 10

docker-compose.yml

@@ -1,4 +1,4 @@
-# MediaStationGo 最简单 Docker Compose 部署文件
+# MMTL 最简单 Docker Compose 部署文件
 #
 # 新手建议：
 #   1. 不用 .env。
@@ -15,12 +15,12 @@
 #   admin / admin123
 
 services:
-  mediastation-go:
+  mmtl:
     # 镜像二选一：
     # 方式一：GitHub 仓库镜像 GHCR（默认，推荐）
-    image: ghcr.io/shukebta/mediastation-go:latest
+    image: ghcr.io/shukebta/mmtl:latest
     # 方式二：Docker Hub 备用（GHCR 拉取慢或不可用时使用）
-    # image: shukbet/mediastationgo:latest
+    # image: shukbet/mmtl:latest
 
     restart: unless-stopped
     init: true
@@ -87,52 +87,52 @@ services:
       PGID: "1000"
 
       # 程序基础配置，通常不用改。
-      MEDIASTATION_APP_HOST: 0.0.0.0
-      MEDIASTATION_APP_PORT: 8080
-      MEDIASTATION_APP_WEB_DIR: /app/web/dist
-      MEDIASTATION_APP_DATA_DIR: /data
+      MMTL_APP_HOST: 0.0.0.0
+      MMTL_APP_PORT: 8080
+      MMTL_APP_WEB_DIR: /app/web/dist
+      MMTL_APP_DATA_DIR: /data
       # 详细应用日志会保存在 ./data/logs/app.log，warn/error 也会拆分保存。
       # 排查复杂问题时可临时改成 debug。
-      MEDIASTATION_LOGGING_LEVEL: info
-      MEDIASTATION_LOGGING_FORMAT: console
-      MEDIASTATION_LOGGING_OUTPUT_PATH: /data/logs
-      MEDIASTATION_LOGGING_MAX_SIZE_MB: "50"
-      MEDIASTATION_LOGGING_MAX_BACKUPS: "20"
-      MEDIASTATION_LOGGING_MAX_AGE_DAYS: "30"
+      MMTL_LOGGING_LEVEL: info
+      MMTL_LOGGING_FORMAT: console
+      MMTL_LOGGING_OUTPUT_PATH: /data/logs
+      MMTL_LOGGING_MAX_SIZE_MB: "50"
+      MMTL_LOGGING_MAX_BACKUPS: "20"
+      MMTL_LOGGING_MAX_AGE_DAYS: "30"
 
       # 轻量模式默认只使用 PostgreSQL，适合大多数 NAS。
-      # 旧版 ./data/mediastation.db 存在时，首次启动会自动迁移到 PostgreSQL。
-      MEDIASTATION_DATABASE_TYPE: postgres
-      MEDIASTATION_DATABASE_DSN: postgres://mediastation:mediastation@postgres:5432/mediastation?sslmode=disable
+      # 旧版 ./data/mmtl.db 存在时，首次启动会自动迁移到 PostgreSQL。
+      MMTL_DATABASE_TYPE: postgres
+      MMTL_DATABASE_DSN: postgres://mmtl:mmtl@postgres:5432/mmtl?sslmode=disable
 
       # SQLite 旧库迁移源：
-      # - 首次从旧版 ./data/mediastation.db 导入时保持此路径。
+      # - 首次从旧版 ./data/mmtl.db 导入时保持此路径。
       # - 确认迁移完成后，建议改成 /data/no-sqlite-migration.db 这类不存在的路径。
-      MEDIASTATION_DATABASE_DB_PATH: /data/mediastation.db
-      MEDIASTATION_CACHE_CACHE_DIR: /cache
+      MMTL_DATABASE_DB_PATH: /data/mmtl.db
+      MMTL_CACHE_CACHE_DIR: /cache
 
       # 管理面板热更新默认拉取此镜像，并用 Watchtower 一次性重建当前容器。
-      MEDIASTATION_UPDATE_IMAGE: ghcr.io/shukebta/mediastation-go:latest
+      MMTL_UPDATE_IMAGE: ghcr.io/shukebta/mmtl:latest
 
       # 路径换算配置。
       # 默认推荐在网页里使用容器路径 /media。
       # 如果旧媒体库已经保存了宿主机路径 /vol1/1000/Media，
       # 再把这里改成同一个宿主机真实路径用于旧路径换算。
-      MEDIASTATION_MEDIA_DIR: /media
-      MEDIASTATION_MEDIA_CONTAINER_DIR: /media
+      MMTL_MEDIA_DIR: /media
+      MMTL_MEDIA_CONTAINER_DIR: /media
 
       # 默认推荐下载器保存路径使用 /downloads。
       # 如果下载器只能返回宿主机路径，再改成同一个宿主机真实路径。
-      MEDIASTATION_DOWNLOAD_DIR: /downloads
-      MEDIASTATION_DOWNLOAD_CONTAINER_DIR: /downloads
+      MMTL_DOWNLOAD_DIR: /downloads
+      MMTL_DOWNLOAD_CONTAINER_DIR: /downloads
 
       # NAS 友好的低负载默认值。
-      MEDIASTATION_TRANSCODER_ENABLED: "true"
-      MEDIASTATION_TRANSCODER_HARDWARE_ACCEL: "false"
-      MEDIASTATION_TRANSCODER_REALTIME: "true"
-      MEDIASTATION_TRANSCODER_THREADS: "2"
-      MEDIASTATION_TRANSCODER_MAX_CONCURRENT: "1"
-      MEDIASTATION_TRANSCODER_IDLE_TIMEOUT_SECONDS: "120"
+      MMTL_TRANSCODER_ENABLED: "true"
+      MMTL_TRANSCODER_HARDWARE_ACCEL: "false"
+      MMTL_TRANSCODER_REALTIME: "true"
+      MMTL_TRANSCODER_THREADS: "2"
+      MMTL_TRANSCODER_MAX_CONCURRENT: "1"
+      MMTL_TRANSCODER_IDLE_TIMEOUT_SECONDS: "120"
 
     healthcheck:
       test: ["CMD-SHELL", "busybox wget -qO- http://127.0.0.1:8080/api/health || exit 1"]
@@ -150,20 +150,20 @@ services:
 
   postgres:
     image: postgres:16-alpine
-    # 首次部署允许拉取；日常更新请只 pull mediastation-go。
+    # 首次部署允许拉取；日常更新请只 pull mmtl。
     # 如需升级 PostgreSQL，请先备份 ./postgres 后再手动调整镜像版本并拉取。
     pull_policy: missing
     restart: unless-stopped
     environment:
-      POSTGRES_DB: mediastation
-      POSTGRES_USER: mediastation
-      POSTGRES_PASSWORD: mediastation
+      POSTGRES_DB: mmtl
+      POSTGRES_USER: mmtl
+      POSTGRES_PASSWORD: mmtl
       TZ: Asia/Shanghai
     volumes:
       # PostgreSQL 主数据目录。升级/重建容器时必须保留。
       - ./postgres:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mediastation -d mediastation"]
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mmtl -d mmtl"]
       interval: 10s
       timeout: 5s
       retries: 10

docker-entrypoint.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 set -eu
 
-run_uid="${PUID:-$(id -u mediastation 2>/dev/null || echo 1000)}"
-run_gid="${PGID:-$(id -g mediastation 2>/dev/null || echo 1000)}"
+run_uid="${PUID:-$(id -u mmtl 2>/dev/null || echo 1000)}"
+run_gid="${PGID:-$(id -g mmtl 2>/dev/null || echo 1000)}"
 
 case "$run_uid" in
   ''|*[!0-9]*)
@@ -19,10 +19,10 @@ case "$run_gid" in
 esac
 
 if [ "$run_uid" = "0" ]; then
-  exec mediastation-go
+  exec mmtl
 fi
 
 chown -R "$run_uid:$run_gid" /data /cache 2>/dev/null || true
 chown "$run_uid:$run_gid" /media 2>/dev/null || true
 
-exec su-exec "$run_uid:$run_gid" mediastation-go
+exec su-exec "$run_uid:$run_gid" mmtl

go.mod

@@ -1,8 +1,9 @@
-module github.com/ShukeBta/MediaStationGo
+module github.com/ShukeBta/MMTL
 
 go 1.25.0
 
 require (
+	github.com/aliyun/alibabacloud-oss-go-sdk-v2 v1.5.2
 	github.com/fsnotify/fsnotify v1.7.0
 	github.com/gin-gonic/gin v1.9.1
 	github.com/glebarez/sqlite v1.11.0
@@ -16,6 +17,7 @@ require (
 	go.uber.org/zap v1.27.0
 	golang.org/x/crypto v0.21.0
 	golang.org/x/sys v0.20.0
+	golang.org/x/time v0.15.0
 	gorm.io/driver/postgres v1.5.7
 	gorm.io/gorm v1.30.0
 )
@@ -66,13 +68,13 @@ require (
 	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.11 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.uber.org/multierr v1.10.0 // indirect
 	golang.org/x/arch v0.3.0 // indirect
 	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
 	golang.org/x/net v0.21.0 // indirect
 	golang.org/x/text v0.20.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

go.sum

@@ -1,3 +1,5 @@
+github.com/aliyun/alibabacloud-oss-go-sdk-v2 v1.5.2 h1:40yUSXwdkWN851BHCq6uiDhleh7A4+0yIBS+IUAqZVY=
+github.com/aliyun/alibabacloud-oss-go-sdk-v2 v1.5.2/go.mod h1:FTzydeQVmR24FI0D6XWUOMKckjXehM/jgMn1xC+DA9M=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
@@ -150,6 +152,8 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
 github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
+github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

internal/config/config.go

@@ -4,7 +4,7 @@
 //  1. 内置默认值
 //  2. 工作目录中的 config.yaml（嵌套格式）
 //  3. config/*.yaml 分片文件（按模块）
-//  4. 以 MEDIASTATION_ 为前缀的环境变量
+//  4. 以 MMTL_ 为前缀的环境变量
 package config
 
 import (
@@ -17,7 +17,7 @@ import (
 )
 
 // EnvPrefix 是所有环境变量驱动的覆盖使用的前缀。
-const EnvPrefix = "MEDIASTATION"
+const EnvPrefix = "MMTL"
 
 // Load 从默认值 / 文件 / 环境读取配置。
 //

internal/config/config_test.go

@@ -40,13 +40,13 @@ func TestLoadDefaults(t *testing.T) {
 	if cfg.Database.MaxOpenConns != defaultDatabaseMaxOpenConns {
 		t.Fatalf("expected default MaxOpenConns %d, got %d", defaultDatabaseMaxOpenConns, cfg.Database.MaxOpenConns)
 	}
-	if cfg.Cache.RedisPrefix != "mediastationgo" {
+	if cfg.Cache.RedisPrefix != "mmtl" {
 		t.Fatalf("expected default redis prefix, got %q", cfg.Cache.RedisPrefix)
 	}
 	if cfg.Cache.MediaTTLSeconds != 15 {
 		t.Fatalf("expected default media cache ttl 15, got %d", cfg.Cache.MediaTTLSeconds)
 	}
-	if cfg.Search.Index != "mediastation_media" {
+	if cfg.Search.Index != "mmtl_media" {
 		t.Fatalf("expected default search index, got %q", cfg.Search.Index)
 	}
 	if cfg.Database.MaxIdleConns != defaultDatabaseMaxIdleConns {
@@ -74,7 +74,7 @@ func TestLoadDefaults(t *testing.T) {
 	}
 }
 
-// TestEnvOverride checks that MEDIASTATION_* env vars override the defaults.
+// TestEnvOverride checks that MMTL_* env vars override the defaults.
 func TestEnvOverride(t *testing.T) {
 	dir := t.TempDir()
 	wd, _ := os.Getwd()
@@ -83,16 +83,16 @@ func TestEnvOverride(t *testing.T) {
 		t.Fatalf("chdir: %v", err)
 	}
 
-	t.Setenv("MEDIASTATION_APP_PORT", "9090")
-	t.Setenv("MEDIASTATION_DATABASE_TYPE", "postgres")
-	t.Setenv("MEDIASTATION_DATABASE_DSN", "postgres://msgo:secret@postgres:5432/msgo?sslmode=disable")
-	t.Setenv("MEDIASTATION_CACHE_REDIS_URL", "redis://redis:6379/0")
-	t.Setenv("MEDIASTATION_CACHE_MEDIA_TTL_SECONDS", "30")
-	t.Setenv("MEDIASTATION_SEARCH_BACKEND", "opensearch")
-	t.Setenv("MEDIASTATION_SEARCH_OPENSEARCH_URL", "http://opensearch:9200")
-	t.Setenv("MEDIASTATION_LICENSE_SERVER_URL", "https://license.example.com")
-	t.Setenv("MEDIASTATION_LICENSE_HMAC_SECRET", "override-secret")
-	t.Setenv("MEDIASTATION_LICENSE_PUBLIC_KEY", "override-public-key")
+	t.Setenv("MMTL_APP_PORT", "9090")
+	t.Setenv("MMTL_DATABASE_TYPE", "postgres")
+	t.Setenv("MMTL_DATABASE_DSN", "postgres://mmtl:secret@postgres:5432/mmtl?sslmode=disable")
+	t.Setenv("MMTL_CACHE_REDIS_URL", "redis://redis:6379/0")
+	t.Setenv("MMTL_CACHE_MEDIA_TTL_SECONDS", "30")
+	t.Setenv("MMTL_SEARCH_BACKEND", "opensearch")
+	t.Setenv("MMTL_SEARCH_OPENSEARCH_URL", "http://opensearch:9200")
+	t.Setenv("MMTL_LICENSE_SERVER_URL", "https://license.example.com")
+	t.Setenv("MMTL_LICENSE_HMAC_SECRET", "override-secret")
+	t.Setenv("MMTL_LICENSE_PUBLIC_KEY", "override-public-key")
 	cfg, err := Load()
 	if err != nil {
 		t.Fatalf("Load() error: %v", err)

internal/config/defaults.go

@@ -3,8 +3,8 @@ package config
 import "github.com/spf13/viper"
 
 const (
-	defaultDatabaseMaxOpenConns = 4
-	defaultDatabaseMaxIdleConns = 2
+	defaultDatabaseMaxOpenConns = 16
+	defaultDatabaseMaxIdleConns = 4
 	defaultLicenseServerURL     = "https://mgosever.3jzs.com"
 	defaultLicensePublicKey     = "MCowBQYDK2VwAyEABRXnXy+urjrbKit6Yu/HiezWgP0NdsZW3tsegJWRrtI="
 )
@@ -25,7 +25,7 @@ func setDefaults(v *viper.Viper) {
 	v.SetDefault("app.server_url", "")
 
 	v.SetDefault("database.type", "auto")
-	v.SetDefault("database.db_path", "./data/mediastation.db")
+	v.SetDefault("database.db_path", "./data/mmtl.db")
 	v.SetDefault("database.dsn", "")
 	v.SetDefault("database.wal_mode", true)
 	v.SetDefault("database.busy_timeout", 5000)
@@ -45,12 +45,12 @@ func setDefaults(v *viper.Viper) {
 	v.SetDefault("cache.cache_dir", "./cache")
 	v.SetDefault("cache.cleanup_interval_min", 60)
 	v.SetDefault("cache.redis_url", "")
-	v.SetDefault("cache.redis_prefix", "mediastationgo")
+	v.SetDefault("cache.redis_prefix", "mmtl")
 	v.SetDefault("cache.media_ttl_seconds", 15)
 
 	v.SetDefault("search.backend", "")
 	v.SetDefault("search.opensearch_url", "")
-	v.SetDefault("search.index", "mediastation_media")
+	v.SetDefault("search.index", "mmtl_media")
 	v.SetDefault("search.username", "")
 	v.SetDefault("search.password", "")
 
@@ -63,7 +63,7 @@ func setDefaults(v *viper.Viper) {
 
 	v.SetDefault("flaresolverr.enabled", false)
 	v.SetDefault("flaresolverr.url", "http://localhost:8191")
-	v.SetDefault("flaresolverr.session", "mediastation")
+	v.SetDefault("flaresolverr.session", "mmtl")
 	v.SetDefault("flaresolverr.timeout", 60)
 
 	v.SetDefault("downloads.smart_classify", true)

internal/config/normalize.go

@@ -15,7 +15,7 @@ func (c *Config) normalize() error {
 		c.App.DataDir = "./data"
 	}
 	if c.Database.DBPath == "" {
-		c.Database.DBPath = filepath.Join(c.App.DataDir, "mediastation.db")
+		c.Database.DBPath = filepath.Join(c.App.DataDir, "mmtl.db")
 	}
 	if c.Database.Type == "" {
 		c.Database.Type = "auto"
@@ -45,14 +45,14 @@ func (c *Config) normalize() error {
 		c.Cache.CacheDir = filepath.Join(c.App.DataDir, "cache")
 	}
 	if c.Cache.RedisPrefix == "" {
-		c.Cache.RedisPrefix = "mediastationgo"
+		c.Cache.RedisPrefix = "mmtl"
 	}
 	if c.Cache.MediaTTLSeconds < 1 {
 		c.Cache.MediaTTLSeconds = 15
 	}
 	c.Search.Backend = strings.ToLower(strings.TrimSpace(c.Search.Backend))
 	if c.Search.Index == "" {
-		c.Search.Index = "mediastation_media"
+		c.Search.Index = "mmtl_media"
 	}
 	if c.Secrets.JWTSecret == "" {
 		// 持久化自动生成的密钥以在操作员忘记配置时保持会话稳定。

internal/config/save.go

@@ -0,0 +1,41 @@
+package config
+
+import (
+	"fmt"
+	"os"
+
+	"gopkg.in/yaml.v3"
+)
+
+// SaveDatabaseConfig updates or creates config.yaml with the specified database configuration.
+func SaveDatabaseConfig(dbType, dsn string) error {
+	configPath := "config.yaml"
+	data := make(map[string]any)
+
+	content, err := os.ReadFile(configPath)
+	if err == nil {
+		if err := yaml.Unmarshal(content, &data); err != nil {
+			data = make(map[string]any)
+		}
+	} else if !os.IsNotExist(err) {
+		return fmt.Errorf("read config.yaml: %w", err)
+	}
+
+	dbSection, ok := data["database"].(map[string]any)
+	if !ok {
+		dbSection = make(map[string]any)
+	}
+	dbSection["type"] = dbType
+	dbSection["dsn"] = dsn
+	data["database"] = dbSection
+
+	out, err := yaml.Marshal(data)
+	if err != nil {
+		return fmt.Errorf("marshal config.yaml: %w", err)
+	}
+
+	if err := os.WriteFile(configPath, out, 0644); err != nil {
+		return fmt.Errorf("write config.yaml: %w", err)
+	}
+	return nil
+}

internal/config/save_test.go

@@ -0,0 +1,36 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestSaveDatabaseConfig(t *testing.T) {
+	dir := t.TempDir()
+	wd, _ := os.Getwd()
+	defer func() { _ = os.Chdir(wd) }()
+	if err := os.Chdir(dir); err != nil {
+		t.Fatalf("chdir: %v", err)
+	}
+
+	dsn := "postgres://admin:pass@127.0.0.1:5432/mmtl?sslmode=disable"
+	if err := SaveDatabaseConfig("postgres", dsn); err != nil {
+		t.Fatalf("SaveDatabaseConfig error: %v", err)
+	}
+
+	if _, err := os.Stat(filepath.Join(dir, "config.yaml")); err != nil {
+		t.Fatalf("expected config.yaml to exist: %v", err)
+	}
+
+	loaded, err := Load()
+	if err != nil {
+		t.Fatalf("Load error: %v", err)
+	}
+	if loaded.Database.Type != "postgres" {
+		t.Fatalf("expected database.type=postgres, got %s", loaded.Database.Type)
+	}
+	if loaded.Database.DSN != dsn {
+		t.Fatalf("expected dsn=%s, got %s", dsn, loaded.Database.DSN)
+	}
+}

internal/config/types.go

@@ -49,6 +49,17 @@ type AppConfig struct {
 	Env         string `mapstructure:"env"`
 	DataDir     string `mapstructure:"data_dir"`
 	WebDir      string `mapstructure:"web_dir"`
+	// HTTPSEnabled 是否仅通过 HTTPS 提供访问。启用时必须同时配置
+	// SSLCert / SSLKey（或 SSLCertPath / SSLKeyPath），保存后服务会热切换到 HTTPS。
+	HTTPSEnabled bool `mapstructure:"https_enabled"`
+	// SSLCert 是 PEM 编码的 SSL 证书内容。
+	SSLCert string `mapstructure:"ssl_cert"`
+	// SSLKey 是 PEM 编码的 SSL 私钥内容。
+	SSLKey string `mapstructure:"ssl_key"`
+	// SSLCertPath 是 SSL 证书文件路径；非空时优先于 SSLCert 从文件读取。
+	SSLCertPath string `mapstructure:"ssl_cert_path"`
+	// SSLKeyPath 是 SSL 私钥文件路径；非空时优先于 SSLKey 从文件读取。
+	SSLKeyPath string `mapstructure:"ssl_key_path"`
 	FFmpegPath  string `mapstructure:"ffmpeg_path"`
 	FFprobePath string `mapstructure:"ffprobe_path"`
 	// FFprobeMaxConcurrent limits concurrent ffprobe/ffmpeg metadata probes.
@@ -140,7 +151,7 @@ type AIConfig struct {
 	MaxConcurrent int    `mapstructure:"max_concurrent"`
 }
 
-// LicenseConfig configures the optional MediaStationGo license server bridge.
+// LicenseConfig configures the optional MMTL license server bridge.
 type LicenseConfig struct {
 	ServerURL  string `mapstructure:"server_url"`
 	HMACSecret string `mapstructure:"hmac_secret"`

internal/database/database.go

@@ -13,7 +13,7 @@ import (
 	"gorm.io/gorm"
 	"gorm.io/gorm/logger"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MMTL/internal/config"
 )
 
 // Open initialises the configured GORM database. database.type=auto chooses

internal/database/database_admin.go

@@ -0,0 +1,223 @@
+package database
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+)
+
+// DatabaseStatus describes the currently active database engine and runtime metrics.
+type DatabaseStatus struct {
+	Type         string           `json:"type"`
+	DSN          string           `json:"dsn,omitempty"`
+	DBPath       string           `json:"db_path,omitempty"`
+	OpenConns    int              `json:"open_conns"`
+	InUse        int              `json:"in_use"`
+	Idle         int              `json:"idle"`
+	MaxOpenConns int              `json:"max_open_conns"`
+	TableCounts  map[string]int64 `json:"table_counts"`
+}
+
+// PostgresTestResult returns latency and version info after testing connection.
+type PostgresTestResult struct {
+	Success   bool   `json:"success"`
+	LatencyMS int64  `json:"latency_ms"`
+	Version   string `json:"version,omitempty"`
+	Message   string `json:"message,omitempty"`
+	Error     string `json:"error,omitempty"`
+}
+
+// DatabaseMigrationResult returns row counts and execution duration of migration.
+type DatabaseMigrationResult struct {
+	Success    bool             `json:"success"`
+	TotalRows  int64            `json:"total_rows"`
+	TableRows  map[string]int64 `json:"table_rows"`
+	DurationMS int64            `json:"duration_ms"`
+	Message    string           `json:"message,omitempty"`
+	Error      string           `json:"error,omitempty"`
+}
+
+// InspectDatabaseStatus queries the currently active database for metrics and table rows.
+func InspectDatabaseStatus(db *gorm.DB, cfg *config.Config) *DatabaseStatus {
+	st := &DatabaseStatus{
+		Type:        "sqlite",
+		TableCounts: make(map[string]int64),
+	}
+	if cfg != nil {
+		st.DBPath = cfg.Database.DBPath
+		if cfg.Database.Type == "postgres" || (cfg.Database.Type == "auto" && strings.TrimSpace(cfg.Database.DSN) != "") {
+			st.Type = "postgres"
+			st.DSN = MaskDSN(cfg.Database.DSN)
+		}
+	}
+	if isPostgres(db) {
+		st.Type = "postgres"
+	}
+
+	if db != nil {
+		if sqlDB, err := db.DB(); err == nil {
+			stats := sqlDB.Stats()
+			st.OpenConns = stats.OpenConnections
+			st.InUse = stats.InUse
+			st.Idle = stats.Idle
+			st.MaxOpenConns = stats.MaxOpenConnections
+		}
+
+		// Count rows for major model tables
+		for _, m := range model.AllModels() {
+			if tbl, err := modelTableName(db, m); err == nil {
+				if db.Migrator().HasTable(tbl) {
+					var count int64
+					if err := db.Raw("SELECT COUNT(1) FROM " + quoteIdent(tbl)).Scan(&count).Error; err == nil {
+						st.TableCounts[tbl] = count
+					}
+				}
+			}
+		}
+	}
+	return st
+}
+
+// TestPostgres establishes a temporary connection to verify reachability and permissions.
+func TestPostgres(dsn string) (*PostgresTestResult, error) {
+	dsn = strings.TrimSpace(dsn)
+	if dsn == "" {
+		return &PostgresTestResult{
+			Success: false,
+			Error:   "PostgreSQL DSN 不能为空",
+		}, nil
+	}
+
+	start := time.Now()
+	testDB, err := gorm.Open(postgres.Open(dsn), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		return &PostgresTestResult{
+			Success: false,
+			Error:   fmt.Sprintf("连接失败: %v", err),
+		}, nil
+	}
+
+	sqlDB, err := testDB.DB()
+	if err != nil {
+		return &PostgresTestResult{
+			Success: false,
+			Error:   fmt.Sprintf("获取底层连接失败: %v", err),
+		}, nil
+	}
+	defer sqlDB.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	if err := sqlDB.PingContext(ctx); err != nil {
+		return &PostgresTestResult{
+			Success: false,
+			Error:   fmt.Sprintf("Ping 超时或失败: %v", err),
+		}, nil
+	}
+
+	var version string
+	if err := testDB.WithContext(ctx).Raw("SELECT version()").Scan(&version).Error; err != nil {
+		version = "PostgreSQL (unknown version)"
+	}
+
+	latency := time.Since(start).Milliseconds()
+	return &PostgresTestResult{
+		Success:   true,
+		LatencyMS: latency,
+		Version:   version,
+		Message:   "连接成功",
+	}, nil
+}
+
+// MigrateCurrentToPostgres performs schema initialization and full table data copy into target PostgreSQL.
+func MigrateCurrentToPostgres(src *gorm.DB, targetDSN string, batchSize int, log *zap.Logger) (*DatabaseMigrationResult, error) {
+	targetDSN = strings.TrimSpace(targetDSN)
+	if targetDSN == "" {
+		return nil, fmt.Errorf("target PostgreSQL DSN cannot be empty")
+	}
+	if src == nil {
+		return nil, fmt.Errorf("current database is not available")
+	}
+
+	started := time.Now()
+	targetDB, err := gorm.Open(postgres.Open(targetDSN), &gorm.Config{
+		Logger: newGormLogger(log),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("open target PostgreSQL: %w", err)
+	}
+	targetSQLDB, err := targetDB.DB()
+	if err == nil {
+		defer targetSQLDB.Close()
+	}
+
+	// 1. 初始化目标库 Schema、类型与索引
+	if err := AutoMigrate(targetDB); err != nil {
+		return nil, fmt.Errorf("auto migrate target PostgreSQL: %w", err)
+	}
+
+	// 2. 安全重置目标数据库的初始默认数据
+	if err := resetBootstrapTargetBeforeSQLiteMigrationIfSafe(src, targetDB, log); err != nil {
+		return nil, fmt.Errorf("reset target bootstrap data: %w", err)
+	}
+
+	// 3. 执行数据批量复制
+	tableRows, totalRows, err := copyModelTables(src, targetDB, batchSize)
+	if err != nil {
+		return nil, fmt.Errorf("copy tables: %w", err)
+	}
+
+	// 4. 标记迁移完成
+	if err := markSQLiteMigrationComplete(targetDB); err != nil {
+		return nil, fmt.Errorf("mark migration complete: %w", err)
+	}
+
+	duration := time.Since(started).Milliseconds()
+	return &DatabaseMigrationResult{
+		Success:    true,
+		TotalRows:  totalRows,
+		TableRows:  tableRows,
+		DurationMS: duration,
+		Message:    fmt.Sprintf("成功迁移 %d 条记录至 PostgreSQL", totalRows),
+	}, nil
+}
+
+// MaskDSN masks the password in a connection string for safe API responses.
+func MaskDSN(rawDSN string) string {
+	rawDSN = strings.TrimSpace(rawDSN)
+	if rawDSN == "" {
+		return ""
+	}
+	if u, err := url.Parse(rawDSN); err == nil && u.User != nil {
+		if pass, hasPassword := u.User.Password(); hasPassword && pass != "" {
+			rawUserPass := u.User.String()
+			user := u.User.Username()
+			maskedUserPass := user + ":******"
+			return strings.Replace(rawDSN, rawUserPass+"@", maskedUserPass+"@", 1)
+		}
+	}
+	// Fallback for keyword-style DSN (e.g. host=... password=...)
+	if strings.Contains(rawDSN, "password=") {
+		parts := strings.Fields(rawDSN)
+		for i, p := range parts {
+			if strings.HasPrefix(p, "password=") {
+				parts[i] = "password=******"
+			}
+		}
+		return strings.Join(parts, " ")
+	}
+	return rawDSN
+}

internal/database/database_admin_test.go

@@ -0,0 +1,71 @@
+package database
+
+import (
+	"testing"
+
+	"github.com/glebarez/sqlite"
+	"gorm.io/gorm"
+
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+)
+
+func TestMaskDSN(t *testing.T) {
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{
+			in:   "postgres://admin:secret123@localhost:5432/mmtl?sslmode=disable",
+			want: "postgres://admin:******@localhost:5432/mmtl?sslmode=disable",
+		},
+		{
+			in:   "host=localhost port=5432 user=admin password=secret dbname=mmtl sslmode=disable",
+			want: "host=localhost port=5432 user=admin password=****** dbname=mmtl sslmode=disable",
+		},
+		{
+			in:   "sqlite://data/mmtl.db",
+			want: "sqlite://data/mmtl.db",
+		},
+		{
+			in:   "",
+			want: "",
+		},
+	}
+
+	for _, c := range cases {
+		got := MaskDSN(c.in)
+		if got != c.want {
+			t.Errorf("MaskDSN(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
+
+func TestInspectDatabaseStatus(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.AutoMigrate(&model.User{}, &model.Media{}); err != nil {
+		t.Fatal(err)
+	}
+	_ = db.Create(&model.User{Username: "testuser", PasswordHash: "h", Role: "user"}).Error
+
+	cfg := &config.Config{}
+	cfg.Database.Type = "sqlite"
+	cfg.Database.DBPath = "./data/mmtl.db"
+
+	st := InspectDatabaseStatus(db, cfg)
+	if st == nil {
+		t.Fatal("expected non-nil DatabaseStatus")
+	}
+	if st.Type != "sqlite" {
+		t.Fatalf("expected sqlite, got %s", st.Type)
+	}
+	if st.DBPath != "./data/mmtl.db" {
+		t.Fatalf("expected db_path, got %s", st.DBPath)
+	}
+	if st.TableCounts["users"] != 1 {
+		t.Fatalf("expected 1 user, got %d", st.TableCounts["users"])
+	}
+}

internal/database/database_test.go

@@ -8,8 +8,8 @@ import (
 	"github.com/glebarez/sqlite"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
 )
 
 func TestOpenRequiresConfig(t *testing.T) {
@@ -28,7 +28,7 @@ func TestOpenRequiresConfig(t *testing.T) {
 func TestOpenSQLiteWithNilLoggerConfiguresPool(t *testing.T) {
 	cfg := &config.Config{}
 	cfg.Database.Type = "sqlite"
-	cfg.Database.DBPath = filepath.Join(t.TempDir(), "mediastation.db")
+	cfg.Database.DBPath = filepath.Join(t.TempDir(), "mmtl.db")
 	cfg.Database.WALMode = true
 	cfg.Database.BusyTimeout = 5000
 	cfg.Database.CacheSize = -2000
@@ -159,7 +159,7 @@ func TestCopyModelTablesMigratesExistingSQLiteRows(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	copied, err := copyModelTables(src, dst, 2)
+	_, copied, err := copyModelTables(src, dst, 2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -222,7 +222,7 @@ func TestCopyModelTablesResumesPartialSQLiteMigration(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	copied, err := copyModelTables(src, dst, 2)
+	_, copied, err := copyModelTables(src, dst, 2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -240,7 +240,7 @@ func TestCopyModelTablesResumesPartialSQLiteMigration(t *testing.T) {
 		t.Fatalf("genres = %q, want %q", got.Genres, media.Genres)
 	}
 
-	copied, err = copyModelTables(src, dst, 2)
+	_, copied, err = copyModelTables(src, dst, 2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -278,7 +278,7 @@ func TestSQLiteMigrationCompleteMarker(t *testing.T) {
 
 func TestSQLiteMigrationFallsBackToDataDirDefaultPath(t *testing.T) {
 	dir := t.TempDir()
-	sqlitePath := filepath.Join(dir, "mediastation.db")
+	sqlitePath := filepath.Join(dir, "mmtl.db")
 	src, err := gorm.Open(sqlite.Open(sqlitePath), &gorm.Config{})
 	if err != nil {
 		t.Fatal(err)
@@ -332,7 +332,7 @@ func TestSQLiteMigrationFallsBackToDataDirDefaultPath(t *testing.T) {
 	if err := resetBootstrapTargetBeforeSQLiteMigrationIfSafe(src2, dst, nil); err != nil {
 		t.Fatal(err)
 	}
-	copied, err := copyModelTables(src2, dst, 2)
+	_, copied, err := copyModelTables(src2, dst, 2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -362,7 +362,7 @@ func TestSQLiteMigrationFallsBackToDataDirDefaultPath(t *testing.T) {
 
 func TestOpenSQLiteMigrationSourceUsesFallbackSourcePath(t *testing.T) {
 	dir := t.TempDir()
-	sqlitePath := filepath.Join(dir, "mediastation.db")
+	sqlitePath := filepath.Join(dir, "mmtl.db")
 	src, err := gorm.Open(sqlite.Open(sqlitePath), &gorm.Config{})
 	if err != nil {
 		t.Fatal(err)
@@ -408,13 +408,13 @@ func TestOpenSQLiteMigrationSourceUsesFallbackSourcePath(t *testing.T) {
 			_ = sqlDB2.Close()
 		}
 	}()
-	copied, err := copyModelTables(src2, dst, 2)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if copied != 2 {
-		t.Fatalf("copied rows = %d, want 2", copied)
-	}
+		_, copied, err := copyModelTables(src2, dst, 2)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if copied != 2 {
+			t.Fatalf("copied rows = %d, want 2", copied)
+		}
 	var userCount int64
 	if err := dst.Model(&model.User{}).Where("username = ?", "real-admin").Count(&userCount).Error; err != nil {
 		t.Fatal(err)

internal/database/schema_library_roots.go

@@ -6,7 +6,7 @@ import (
 
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MMTL/internal/model"
 )
 
 func ensureLibraryRootsCompatibility(db *gorm.DB) error {

internal/database/schema_migration.go

@@ -3,7 +3,7 @@ package database
 import (
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MMTL/internal/model"
 )
 
 // AutoMigrate creates tables for every model registered in the model package.

internal/database/sqlite_migration.go

@@ -7,7 +7,7 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MMTL/internal/config"
 )
 
 // MigrateSQLiteToCurrentIfNeeded copies an existing SQLite database into
@@ -48,7 +48,7 @@ func MigrateSQLiteToCurrentIfNeeded(cfg *config.Config, target *gorm.DB, log *za
 	if err := resetBootstrapTargetBeforeSQLiteMigrationIfSafe(src, target, log); err != nil {
 		return err
 	}
-	copied, err := copyModelTables(src, target, 500)
+	_, copied, err := copyModelTables(src, target, 500)
 	if err != nil {
 		return err
 	}

internal/database/sqlite_migration_bootstrap.go

@@ -9,7 +9,7 @@ import (
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MMTL/internal/model"
 )
 
 func resetBootstrapTargetBeforeSQLiteMigrationIfSafe(src, target *gorm.DB, log *zap.Logger) error {

internal/database/sqlite_migration_copy.go

@@ -10,55 +10,56 @@ import (
 	"gorm.io/gorm/clause"
 	"gorm.io/gorm/schema"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MMTL/internal/model"
 )
 
-func copyModelTables(src, target *gorm.DB, batchSize int) (int64, error) {
+func copyModelTables(src, target *gorm.DB, batchSize int) (map[string]int64, int64, error) {
 	if batchSize <= 0 {
 		batchSize = 500
 	}
-	var copied int64
+	tableCounts := make(map[string]int64)
+	var totalCopied int64
 	for _, m := range model.AllModels() {
 		table, err := modelTableName(src, m)
 		if err != nil {
-			return copied, err
+			return tableCounts, totalCopied, err
 		}
 		primaryColumns, err := modelPrimaryColumns(src, m)
 		if err != nil {
-			return copied, fmt.Errorf("inspect model %T primary keys: %w", m, err)
+			return tableCounts, totalCopied, fmt.Errorf("inspect model %T primary keys: %w", m, err)
 		}
 		exists, err := sqliteTableExists(src, table)
 		if err != nil {
-			return copied, err
+			return tableCounts, totalCopied, err
 		}
 		if !exists {
 			continue
 		}
 		var sourceCount int64
 		if err := src.Raw("SELECT COUNT(1) FROM " + quoteIdent(table)).Scan(&sourceCount).Error; err != nil {
-			return copied, fmt.Errorf("count sqlite table %s: %w", table, err)
+			return tableCounts, totalCopied, fmt.Errorf("count sqlite table %s: %w", table, err)
 		}
 		if sourceCount == 0 {
 			continue
 		}
 		var targetCount int64
 		if err := target.Raw("SELECT COUNT(1) FROM " + quoteIdent(table)).Scan(&targetCount).Error; err != nil {
-			return copied, fmt.Errorf("count target table %s: %w", table, err)
+			return tableCounts, totalCopied, fmt.Errorf("count target table %s: %w", table, err)
 		}
 		modelType := reflect.TypeOf(m)
 		if modelType.Kind() != reflect.Ptr {
-			return copied, fmt.Errorf("model %T is not a pointer", m)
+			return tableCounts, totalCopied, fmt.Errorf("model %T is not a pointer", m)
 		}
 		sliceType := reflect.SliceOf(modelType.Elem())
 		slicePtr := reflect.New(sliceType)
 		if err := src.Unscoped().Find(slicePtr.Interface()).Error; err != nil {
-			return copied, fmt.Errorf("read sqlite table %s: %w", table, err)
+			return tableCounts, totalCopied, fmt.Errorf("read sqlite table %s: %w", table, err)
 		}
 		filtered := slicePtr.Elem()
 		if targetCount > 0 {
 			primaryKeySet, err := targetPrimaryKeySet(target, table, primaryColumns)
 			if err != nil {
-				return copied, err
+				return tableCounts, totalCopied, err
 			}
 			filtered = filterRowsMissingInTarget(target, table, primaryColumns, filtered, primaryKeySet)
 		}
@@ -68,11 +69,13 @@ func copyModelTables(src, target *gorm.DB, batchSize int) (int64, error) {
 		filteredPtr := reflect.New(filtered.Type())
 		filteredPtr.Elem().Set(filtered)
 		if err := target.Clauses(clause.OnConflict{DoNothing: true}).CreateInBatches(filteredPtr.Interface(), batchSize).Error; err != nil {
-			return copied, fmt.Errorf("copy sqlite table %s: %w", table, err)
+			return tableCounts, totalCopied, fmt.Errorf("copy sqlite table %s: %w", table, err)
 		}
-		copied += int64(filtered.Len())
+		copiedForTable := int64(filtered.Len())
+		tableCounts[table] = copiedForTable
+		totalCopied += copiedForTable
 	}
-	return copied, nil
+	return tableCounts, totalCopied, nil
 }
 
 func modelPrimaryColumns(db *gorm.DB, m any) ([]string, error) {

internal/database/sqlite_migration_source.go

@@ -12,7 +12,7 @@ import (
 	"gorm.io/gorm"
 	"gorm.io/gorm/logger"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MMTL/internal/config"
 )
 
 func openSQLiteMigrationSource(cfg *config.Config, sqlitePath string) (*gorm.DB, error) {
@@ -36,7 +36,7 @@ func sqliteMigrationSourcePath(cfg *config.Config, log *zap.Logger) (string, err
 		}
 	}
 
-	fallback := filepath.Join(strings.TrimSpace(cfg.App.DataDir), "mediastation.db")
+	fallback := filepath.Join(strings.TrimSpace(cfg.App.DataDir), "mmtl.db")
 	if fallback == "" || sameCleanPath(configured, fallback) {
 		return "", nil
 	}

internal/database/sqlite_runtime.go

@@ -4,17 +4,18 @@ import (
 	"context"
 	"fmt"
 	"path/filepath"
+	"strings"
 
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MMTL/internal/config"
 )
 
 func installSQLiteWriteGate(db *gorm.DB) {
 	if db == nil {
 		return
 	}
-	const lockedKey = "mediastation:sqlite_write_locked"
+	const lockedKey = "mmtl:sqlite_write_locked"
 	gate := newSQLiteWriteGate()
 	lock := func(tx *gorm.DB) {
 		ctx := context.Background()
@@ -32,14 +33,35 @@ func installSQLiteWriteGate(db *gorm.DB) {
 			gate.Unlock()
 		}
 	}
-	_ = db.Callback().Create().Before("gorm:create").Register("mediastation:sqlite_write_lock", lock)
-	_ = db.Callback().Create().After("gorm:create").Register("mediastation:sqlite_write_unlock", unlock)
-	_ = db.Callback().Update().Before("gorm:update").Register("mediastation:sqlite_write_lock", lock)
-	_ = db.Callback().Update().After("gorm:update").Register("mediastation:sqlite_write_unlock", unlock)
-	_ = db.Callback().Delete().Before("gorm:delete").Register("mediastation:sqlite_write_lock", lock)
-	_ = db.Callback().Delete().After("gorm:delete").Register("mediastation:sqlite_write_unlock", unlock)
-	_ = db.Callback().Raw().Before("gorm:raw").Register("mediastation:sqlite_write_lock", lock)
-	_ = db.Callback().Raw().After("gorm:raw").Register("mediastation:sqlite_write_unlock", unlock)
+	rawLock := func(tx *gorm.DB) {
+		if tx.Statement != nil && isReadOnlySQL(tx.Statement.SQL.String()) {
+			return
+		}
+		lock(tx)
+	}
+	_ = db.Callback().Create().Before("gorm:create").Register("mmtl:sqlite_write_lock", lock)
+	_ = db.Callback().Create().After("gorm:create").Register("mmtl:sqlite_write_unlock", unlock)
+	_ = db.Callback().Update().Before("gorm:update").Register("mmtl:sqlite_write_lock", lock)
+	_ = db.Callback().Update().After("gorm:update").Register("mmtl:sqlite_write_unlock", unlock)
+	_ = db.Callback().Delete().Before("gorm:delete").Register("mmtl:sqlite_write_lock", lock)
+	_ = db.Callback().Delete().After("gorm:delete").Register("mmtl:sqlite_write_unlock", unlock)
+	_ = db.Callback().Raw().Before("gorm:raw").Register("mmtl:sqlite_write_lock", rawLock)
+	_ = db.Callback().Raw().After("gorm:raw").Register("mmtl:sqlite_write_unlock", unlock)
+}
+
+func isReadOnlySQL(sql string) bool {
+	trimmed := strings.TrimSpace(sql)
+	if len(trimmed) == 0 {
+		return false
+	}
+	upper := strings.ToUpper(trimmed)
+	if strings.HasPrefix(upper, "SELECT") || strings.HasPrefix(upper, "EXPLAIN") {
+		return true
+	}
+	if strings.HasPrefix(upper, "WITH") && !strings.Contains(upper, "INSERT") && !strings.Contains(upper, "UPDATE") && !strings.Contains(upper, "DELETE") {
+		return true
+	}
+	return false
 }
 
 // sqliteWriteGate serializes in-process SQLite writes while respecting the
@@ -84,7 +106,7 @@ func buildSQLiteDSN(cfg *config.Config) string {
 	}
 	dsn := dbPath + "?_pragma=foreign_keys(1)"
 	if cfg.Database.WALMode {
-		dsn += "&_pragma=journal_mode(WAL)"
+		dsn += "&_pragma=journal_mode(WAL)&_pragma=synchronous(NORMAL)"
 	}
 	if cfg.Database.BusyTimeout > 0 {
 		dsn += fmt.Sprintf("&_pragma=busy_timeout(%d)", cfg.Database.BusyTimeout)
@@ -92,6 +114,7 @@ func buildSQLiteDSN(cfg *config.Config) string {
 	if cfg.Database.CacheSize != 0 {
 		dsn += fmt.Sprintf("&_pragma=cache_size(%d)", cfg.Database.CacheSize)
 	}
+	dsn += "&_pragma=temp_store(MEMORY)&_pragma=mmap_size(268435456)"
 	return dsn
 }
 

internal/handler/active_user.go

@@ -6,8 +6,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 const embyCtxUserName = "emby_user_name"

internal/handler/admin.go

@@ -3,14 +3,15 @@ package handler
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"net/http"
 	"strings"
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func listUsersHandler(svc *service.Container) gin.HandlerFunc {
@@ -27,6 +28,9 @@ func listUsersHandler(svc *service.Container) gin.HandlerFunc {
 		if svc.Sessions != nil {
 			svc.Sessions.ApplyToUsers(c.Request.Context(), users)
 		}
+		for i := range users {
+			users[i].PopulateComputedFields()
+		}
 		c.JSON(http.StatusOK, users)
 	}
 }
@@ -188,19 +192,77 @@ func updateUserStatusHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
-		if req.IsActive {
-			_ = svc.Repo.UserDevice.SetKickedByUser(c.Request.Context(), userID, false)
-		} else {
-			_ = svc.Repo.UserDevice.SetKickedByUser(c.Request.Context(), userID, true)
+			if req.IsActive {
+				_ = svc.Repo.UserDevice.SetKickedByUser(c.Request.Context(), userID, false)
+			} else {
+				_ = svc.Repo.UserDevice.SetKickedByUser(c.Request.Context(), userID, true)
+			}
+			updated, err := svc.Repo.User.FindByID(c.Request.Context(), userID)
+			if err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+			updated.PopulateComputedFields()
+			c.JSON(http.StatusOK, updated)
+		}
+	}
+
+	type adminUpdateUserLibrariesReq struct {
+		AllowedLibraryIDs *[]string `json:"allowed_library_ids"`
+	}
+
+	func updateUserLibrariesHandler(svc *service.Container) gin.HandlerFunc {
+		return func(c *gin.Context) {
+			var req adminUpdateUserLibrariesReq
+			if err := c.ShouldBindJSON(&req); err != nil {
+				c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+				return
+			}
+			userID := c.Param("id")
+			user, err := svc.Repo.User.FindByID(c.Request.Context(), userID)
+			if err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+			if user == nil {
+				c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
+				return
+			}
+
+			var rawJSON string
+			if req.AllowedLibraryIDs != nil && len(*req.AllowedLibraryIDs) > 0 {
+				var cleanIDs []string
+				for _, id := range *req.AllowedLibraryIDs {
+					trimmed := strings.TrimSpace(id)
+					if trimmed != "" {
+						cleanIDs = append(cleanIDs, trimmed)
+					}
+				}
+				if len(cleanIDs) > 0 {
+					data, err := json.Marshal(cleanIDs)
+					if err != nil {
+						c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+						return
+					}
+					rawJSON = string(data)
+				}
+			}
+
+			updates := map[string]any{"allowed_library_ids": rawJSON}
+			if err := svc.Repo.User.UpdateFields(c.Request.Context(), userID, updates); err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+
+			updated, err := svc.Repo.User.FindByID(c.Request.Context(), userID)
+			if err != nil || updated == nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to reload user"})
+				return
+			}
+			updated.PopulateComputedFields()
+			c.JSON(http.StatusOK, updated)
 		}
-		updated, err := svc.Repo.User.FindByID(c.Request.Context(), userID)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-			return
-		}
-		c.JSON(http.StatusOK, updated)
 	}
-}
 
 func annotateProtectedUsers(ctx context.Context, svc *service.Container, users []model.User) error {
 	firstAdmin, err := svc.Repo.User.FirstAdmin(ctx)

internal/handler/admin_database.go

@@ -0,0 +1,145 @@
+package handler
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MMTL/internal/service"
+)
+
+type DatabaseConnectionPayload struct {
+	Type     string `json:"type"`
+	DSN      string `json:"dsn"`
+	Host     string `json:"host"`
+	Port     int    `json:"port"`
+	User     string `json:"user"`
+	Password string `json:"password"`
+	DBName   string `json:"dbname"`
+	SSLMode  string `json:"sslmode"`
+}
+
+func (p *DatabaseConnectionPayload) BuildDSN() string {
+	raw := strings.TrimSpace(p.DSN)
+	if raw != "" {
+		return raw
+	}
+	host := strings.TrimSpace(p.Host)
+	if host == "" {
+		return ""
+	}
+	port := p.Port
+	if port <= 0 {
+		port = 5432
+	}
+	user := strings.TrimSpace(p.User)
+	dbname := strings.TrimSpace(p.DBName)
+	if dbname == "" {
+		dbname = "mmtl"
+	}
+	sslmode := strings.TrimSpace(p.SSLMode)
+	if sslmode == "" {
+		sslmode = "disable"
+	}
+
+	userInfo := url.User(user)
+	if p.Password != "" {
+		userInfo = url.UserPassword(user, p.Password)
+	}
+
+	u := url.URL{
+		Scheme:   "postgres",
+		User:     userInfo,
+		Host:     fmt.Sprintf("%s:%d", host, port),
+		Path:     "/" + dbname,
+		RawQuery: "sslmode=" + url.QueryEscape(sslmode),
+	}
+	return u.String()
+}
+
+func getDatabaseStatusHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if svc.Database == nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "database service unavailable"})
+			return
+		}
+		status := svc.Database.GetStatus(c.Request.Context())
+		c.JSON(http.StatusOK, status)
+	}
+}
+
+func testDatabaseHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req DatabaseConnectionPayload
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid payload: " + err.Error()})
+			return
+		}
+		dsn := req.BuildDSN()
+		if dsn == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "请提供有效的 PostgreSQL 连接信息或 DSN"})
+			return
+		}
+		res, err := svc.Database.TestPostgres(c.Request.Context(), dsn)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, res)
+	}
+}
+
+func migrateDatabaseHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req DatabaseConnectionPayload
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid payload: " + err.Error()})
+			return
+		}
+		dsn := req.BuildDSN()
+		if dsn == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "请提供目标 PostgreSQL 连接信息或 DSN"})
+			return
+		}
+		res, err := svc.Database.MigrateToPostgres(c.Request.Context(), dsn)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "迁移失败: " + err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, res)
+	}
+}
+
+func saveDatabaseConfigHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req DatabaseConnectionPayload
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid payload: " + err.Error()})
+			return
+		}
+		dbType := strings.ToLower(strings.TrimSpace(req.Type))
+		if dbType == "" {
+			dbType = "postgres"
+		}
+		var dsn string
+		if dbType == "postgres" {
+			dsn = req.BuildDSN()
+			if dsn == "" {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "请提供有效的 PostgreSQL 连接信息或 DSN"})
+				return
+			}
+		}
+
+		if err := svc.Database.SaveConfig(c.Request.Context(), dbType, dsn); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{
+			"message": "数据库配置已成功保存至配置文件，重启服务后将以新数据库运行",
+			"type":    dbType,
+		})
+	}
+}

internal/handler/admin_database_test.go

@@ -0,0 +1,101 @@
+package handler
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/service"
+)
+
+func TestBuildDSN(t *testing.T) {
+	cases := []struct {
+		payload DatabaseConnectionPayload
+		want    string
+	}{
+		{
+			payload: DatabaseConnectionPayload{
+				DSN: "postgres://myuser:mypass@10.0.0.1:5432/mydb?sslmode=require",
+			},
+			want: "postgres://myuser:mypass@10.0.0.1:5432/mydb?sslmode=require",
+		},
+		{
+			payload: DatabaseConnectionPayload{
+				Host:     "127.0.0.1",
+				Port:     5432,
+				User:     "postgres",
+				Password: "secretpassword",
+				DBName:   "mmtl_prod",
+				SSLMode:  "disable",
+			},
+			want: "postgres://postgres:secretpassword@127.0.0.1:5432/mmtl_prod?sslmode=disable",
+		},
+	}
+
+	for _, c := range cases {
+		got := c.payload.BuildDSN()
+		if got != c.want {
+			t.Errorf("BuildDSN() = %q, want %q", got, c.want)
+		}
+	}
+}
+
+func TestGetDatabaseStatusHandler(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	cfg := &config.Config{}
+	cfg.Database.Type = "sqlite"
+	cfg.Database.DBPath = "./data/mmtl.db"
+
+	svc := &service.Container{
+		Database: service.NewDatabaseAdminService(cfg, nil, nil, nil),
+	}
+
+	r := gin.New()
+	r.GET("/api/admin/database/status", getDatabaseStatusHandler(svc))
+
+	req := httptest.NewRequest(http.MethodGet, "/api/admin/database/status", nil)
+	rec := httptest.NewRecorder()
+	r.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String())
+	}
+
+	var resp map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if resp["type"] != "sqlite" {
+		t.Fatalf("expected type=sqlite, got %v", resp["type"])
+	}
+}
+
+func TestSaveDatabaseConfigHandler(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	dir := t.TempDir()
+	cfg := &config.Config{}
+	cfg.App.DataDir = dir
+	cfg.Database.Type = "sqlite"
+
+	svc := &service.Container{
+		Database: service.NewDatabaseAdminService(cfg, nil, nil, nil),
+	}
+
+	r := gin.New()
+	r.POST("/api/admin/database/save-config", saveDatabaseConfigHandler(svc))
+
+	body := bytes.NewBufferString(`{"type":"postgres","host":"localhost","port":5432,"user":"admin","password":"pwd","dbname":"mmtl"}`)
+	req := httptest.NewRequest(http.MethodPost, "/api/admin/database/save-config", body)
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	r.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String())
+	}
+}

internal/handler/admin_settings.go

@@ -8,9 +8,10 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 type settingReq struct {
@@ -50,6 +51,10 @@ func updateSettingHandler(svc *service.Container) gin.HandlerFunc {
 			_ = svc.Repo.DB.WithContext(c.Request.Context()).Model(&model.User{}).Where("hide_adult = ?", false).Update("hide_adult", true).Error
 		}
 		service.ApplyRuntimeSetting(svc.Cfg, req.Key, req.Value)
+		if err := applyHTTPSetting(svc, req.Key, req.Value); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
 		if svc.FFprobe != nil && (req.Key == "ffprobe.max_concurrent" || req.Key == "app.ffprobe_max_concurrent") {
 			svc.FFprobe.SetMaxConcurrent(svc.Cfg.App.FFprobeMaxConcurrent)
 		}
@@ -63,6 +68,83 @@ func updateSettingHandler(svc *service.Container) gin.HandlerFunc {
 	}
 }
 
+// applyHTTPSetting 校验 HTTPS 相关设置，并在可行时热重载监听。
+// 必须在 ApplyRuntimeSetting 之后调用，这样 svc.Cfg 已反映刚保存的值。
+//
+// 规则：
+//   - https.enabled=true 时强制要求证书与私钥都已配置（内容或路径均可）且匹配，
+//     否则返回错误（"如果启用就必须配置 SSL 证书和密钥"）；
+//   - 证书/私钥（内容或路径）单独保存时只校验格式；若 HTTPS 已开启且新的整体
+//     配置可解析匹配才触发重载，避免"只存了新证书、私钥还没保存"时用旧私钥带
+//     新证书对外提供服务。
+func applyHTTPSetting(svc *service.Container, key, value string) error {
+	skipReload := func(reason string) {
+		if svc.Log != nil {
+			svc.Log.Warn("https setting saved but not applied yet", zap.String("key", key), zap.String("reason", reason))
+		}
+	}
+	switch key {
+	case "https.enabled":
+		if svc.Cfg.App.HTTPSEnabled {
+			if _, err := service.ResolveSSLKeyPair(svc.Cfg.App.SSLCert, svc.Cfg.App.SSLCertPath, svc.Cfg.App.SSLKey, svc.Cfg.App.SSLKeyPath); err != nil {
+				return fmt.Errorf("启用 HTTPS 失败：%v", err)
+			}
+		}
+	case "https.cert", "https.cert_path", "https.key", "https.key_path":
+		if err := validateSSLMaterialSource(key, value); err != nil {
+			return err
+		}
+		if !svc.Cfg.App.HTTPSEnabled {
+			return nil
+		}
+		if !httpsPairReady(svc) {
+			skipReload("证书与私钥尚未匹配，等待另一半保存后生效")
+			return nil
+		}
+	default:
+		return nil
+	}
+	if svc.ReloadHTTPServer != nil {
+		return svc.ReloadHTTPServer()
+	}
+	return nil
+}
+
+// validateSSLMaterialSource 校验刚保存的证书/私钥来源（内容或路径）本身格式合法。
+func validateSSLMaterialSource(key, value string) error {
+	switch key {
+	case "https.cert":
+		return service.ValidateSSLCert(value)
+	case "https.cert_path":
+		if strings.TrimSpace(value) == "" {
+			return nil // 清空路径也允许，启用时由整体校验把关
+		}
+		pemStr, err := service.ResolveSSLMaterial("", value, "证书")
+		if err != nil {
+			return err
+		}
+		return service.ValidateSSLCert(pemStr)
+	case "https.key":
+		return service.ValidateSSLKey(value)
+	case "https.key_path":
+		if strings.TrimSpace(value) == "" {
+			return nil
+		}
+		pemStr, err := service.ResolveSSLMaterial("", value, "私钥")
+		if err != nil {
+			return err
+		}
+		return service.ValidateSSLKey(pemStr)
+	}
+	return nil
+}
+
+// httpsPairReady 判断基于当前配置解析出的证书/私钥是否完整且匹配。
+func httpsPairReady(svc *service.Container) bool {
+	_, err := service.ResolveSSLKeyPair(svc.Cfg.App.SSLCert, svc.Cfg.App.SSLCertPath, svc.Cfg.App.SSLKey, svc.Cfg.App.SSLKeyPath)
+	return err == nil
+}
+
 type testAdultScraperReq struct {
 	Engine    string `json:"engine"`
 	ServerURL string `json:"server_url"`

internal/handler/admin_test.go

@@ -3,6 +3,7 @@ package handler
 import (
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/gin-gonic/gin"
@@ -10,9 +11,9 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestDeleteUserRefusesRecentRealtimeSession(t *testing.T) {
@@ -43,7 +44,92 @@ func TestDeleteUserRefusesRecentRealtimeSession(t *testing.T) {
 	if w.Code != http.StatusConflict {
 		t.Fatalf("status = %d body=%s", w.Code, w.Body.String())
 	}
-	if found, _ := repos.User.FindByID(t.Context(), viewer.ID); found == nil {
-		t.Fatal("recent realtime user should not be deleted")
+		if found, _ := repos.User.FindByID(t.Context(), viewer.ID); found == nil {
+			t.Fatal("recent realtime user should not be deleted")
+		}
+	}
+
+func TestUpdateUserLibraries(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.AutoMigrate(model.AllModels()...); err != nil {
+		t.Fatal(err)
+	}
+	repos := repository.New(db)
+	user := model.User{Base: model.Base{ID: "u1"}, Username: "alice", PasswordHash: "x", Role: "user", IsActive: true}
+	lib1 := model.Library{Base: model.Base{ID: "lib-1"}, Name: "电影", Type: "movie", Path: "/movie"}
+	lib2 := model.Library{Base: model.Base{ID: "lib-2"}, Name: "剧集", Type: "tv", Path: "/tv"}
+	lib3 := model.Library{Base: model.Base{ID: "lib-3"}, Name: "动漫", Type: "anime", Path: "/anime"}
+	if err := repos.DB.Create(&user).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := repos.DB.Create(&[]model.Library{lib1, lib2, lib3}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	svc := &service.Container{Repo: repos}
+	router := gin.New()
+	router.PATCH("/admin/users/:id/libraries", updateUserLibrariesHandler(svc))
+
+	// 1. 设置限制为 lib-1 和 lib-2
+	body := `{"allowed_library_ids":["lib-1","lib-2"]}`
+	req := httptest.NewRequest(http.MethodPatch, "/admin/users/u1/libraries", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", w.Code, w.Body.String())
+	}
+
+	found, err := repos.User.FindByID(t.Context(), "u1")
+	if err != nil || found == nil {
+		t.Fatal("user not found")
+	}
+	allowed := found.DecodeAllowedLibraryIDs()
+	if len(allowed) != 2 || allowed[0] != "lib-1" || allowed[1] != "lib-2" {
+		t.Fatalf("expected [lib-1, lib-2], got %v", allowed)
+	}
+
+	// 验证可见性
+	vis := service.UserDefaultMediaVisibility(t.Context(), repos, "u1")
+	if len(vis.AllowedLibraryIDs) != 2 {
+		t.Fatalf("expected 2 allowed libraries, got %v", vis.AllowedLibraryIDs)
+	}
+	if !service.LibraryVisibleForUser(t.Context(), repos, lib1, vis) {
+		t.Fatal("lib1 should be visible")
+	}
+	if !service.LibraryVisibleForUser(t.Context(), repos, lib2, vis) {
+		t.Fatal("lib2 should be visible")
+	}
+	if service.LibraryVisibleForUser(t.Context(), repos, lib3, vis) {
+		t.Fatal("lib3 should not be visible")
+	}
+
+	// 2. 清空限制，恢复全部可见
+	bodyEmpty := `{"allowed_library_ids":[]}`
+	reqEmpty := httptest.NewRequest(http.MethodPatch, "/admin/users/u1/libraries", strings.NewReader(bodyEmpty))
+	reqEmpty.Header.Set("Content-Type", "application/json")
+	wEmpty := httptest.NewRecorder()
+	router.ServeHTTP(wEmpty, reqEmpty)
+
+	if wEmpty.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", wEmpty.Code, wEmpty.Body.String())
+	}
+
+	foundReset, _ := repos.User.FindByID(t.Context(), "u1")
+	if len(foundReset.DecodeAllowedLibraryIDs()) != 0 {
+		t.Fatalf("expected nil or empty, got %v", foundReset.DecodeAllowedLibraryIDs())
+	}
+
+	visReset := service.UserDefaultMediaVisibility(t.Context(), repos, "u1")
+	if len(visReset.AllowedLibraryIDs) != 0 {
+		t.Fatalf("expected no library restrictions, got %v", visReset.AllowedLibraryIDs)
+	}
+	if !service.LibraryVisibleForUser(t.Context(), repos, lib3, visReset) {
+		t.Fatal("lib3 should now be visible")
 	}
 }

internal/handler/api_config.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func listAPIConfigsHandler(svc *service.Container) gin.HandlerFunc {

internal/handler/api_config_handler.go

@@ -7,7 +7,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // ApiConfigHandler API 配置 HTTP 处理。
@@ -177,7 +177,7 @@ func (h *ApiConfigHandler) TestApiConfig(c *gin.Context) {
 	_ = h.svc.ApiConfig.UpdateTestResult(c.Request.Context(), provider, result)
 
 	c.JSON(http.StatusOK, gin.H{
-		"code": 0,
+		"code":    0,
 		"message": "ok",
 		"data": gin.H{
 			"result": result,

internal/handler/auth.go

@@ -7,8 +7,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 type loginReq struct {
@@ -89,6 +89,7 @@ func meHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
 			return
 		}
+		u.PopulateComputedFields()
 		c.JSON(http.StatusOK, u)
 	}
 }

internal/handler/auth_cookie.go

@@ -7,8 +7,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func setAccessTokenCookie(c *gin.Context, token string, maxAgeSeconds int) {

internal/handler/auth_cookie_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/middleware"
 )
 
 func TestSetAccessTokenCookie(t *testing.T) {

internal/handler/auth_extra.go

@@ -10,8 +10,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // refreshHandler returns a fresh token signed for the current user.

internal/handler/backup.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func createBackupHandler(svc *service.Container) gin.HandlerFunc {

internal/handler/danmaku.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // getDanmakuHandler returns danmaku for a media. ?kw= optionally overrides the
@@ -30,4 +30,4 @@ func getDanmakuConfigHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.JSON(http.StatusOK, svc.Danmaku.Config(c.Request.Context()))
 	}
-}
+}

internal/handler/dlna.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func dlnaListHandler(svc *service.Container) gin.HandlerFunc {

internal/handler/dlna_extra.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // dlnaControlPath maps the action name to the AVTransport SOAP body.

internal/handler/emby_auth.go

@@ -7,8 +7,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // embyError 返回 Emby 风格的错误（顶层 Code/Message）。

internal/handler/emby_auth_test.go

@@ -14,10 +14,10 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestParseEmbyAuthByNameReqAcceptsLowercaseJSON(t *testing.T) {

internal/handler/emby_authed_loop_test.go

@@ -13,10 +13,10 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // TestEmbyLoginThenAuthedRequest simulates the exact flow an Emby-compatible
@@ -144,4 +144,4 @@ func TestEmbyLoginWithAuthorizationHeaderToken(t *testing.T) {
 	if w.Code != http.StatusOK {
 		t.Fatalf("Authorization-token request = %d body=%s", w.Code, w.Body.String())
 	}
-}
+}

internal/handler/emby_discovery_routes_test.go

@@ -12,10 +12,10 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestEmbyWithRequestAddressUsesHost(t *testing.T) {
@@ -24,7 +24,7 @@ func TestEmbyWithRequestAddressUsesHost(t *testing.T) {
 	c, _ := gin.CreateTestContext(w)
 	c.Request = httptest.NewRequest(http.MethodGet, "http://192.168.1.4:18080/System/Info/Public", nil)
 
-	payload := embyWithRequestAddress(c, map[string]any{"Id": "mediastation-go-001"})
+	payload := embyWithRequestAddress(c, map[string]any{"Id": "mmtl-001"})
 
 	if payload["LocalAddress"] != "http://192.168.1.4:18080" {
 		t.Fatalf("unexpected LocalAddress: %#v", payload["LocalAddress"])
@@ -42,7 +42,7 @@ func TestEmbyWithRequestAddressHonorsForwardedHeaders(t *testing.T) {
 	c.Request.Header.Set("X-Forwarded-Proto", "https")
 	c.Request.Header.Set("X-Forwarded-Host", "media.example.test")
 
-	payload := embyWithRequestAddress(c, map[string]any{"Id": "mediastation-go-001"})
+	payload := embyWithRequestAddress(c, map[string]any{"Id": "mmtl-001"})
 
 	if payload["LocalAddress"] != "https://media.example.test" {
 		t.Fatalf("unexpected LocalAddress: %#v", payload["LocalAddress"])

internal/handler/emby_images.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 var embyPlaceholderPNG = []byte{

internal/handler/emby_items_handlers.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func parseEmbyItemsParams(c *gin.Context) service.ItemsParams {

internal/handler/emby_items_test.go

@@ -14,10 +14,10 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestEmbyItemImageServesWithoutAPIAuth(t *testing.T) {

internal/handler/emby_misc_routes_test.go

@@ -13,9 +13,9 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestEmbyVirtualFoldersRouteReturnsJSON(t *testing.T) {

internal/handler/emby_playback.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func embyPlaybackInfoHandler(svc *service.Container) gin.HandlerFunc {

internal/handler/emby_playback_info_routes_test.go

@@ -13,10 +13,10 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestEmbyLowercasePlaybackInfoRouteReturnsJSON(t *testing.T) {

internal/handler/emby_playback_routes_test.go

@@ -12,10 +12,10 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestEmbyLowercaseVideoStreamRouteServesMedia(t *testing.T) {

internal/handler/emby_playstate_handlers.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 type embyPlayingReq struct {

internal/handler/emby_routes.go

@@ -5,8 +5,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // registerEmbyRoutes 在 r 上挂双前缀（"" + "/emby"）的 Emby 兼容路由。

internal/handler/emby_routes_lowercase.go

@@ -3,7 +3,7 @@ package handler
 import (
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func registerLowercaseEmbyAuthRoutes(auth *gin.RouterGroup, svc *service.Container) {

internal/handler/emby_session_routes_test.go

@@ -14,10 +14,10 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestEmbyMarkPlayedRefreshesPlaybackDevice(t *testing.T) {

internal/handler/emby_sessions.go

@@ -7,8 +7,8 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func embySessionsHandler(svc *service.Container) gin.HandlerFunc {
@@ -29,7 +29,7 @@ func embySessionsHandler(svc *service.Container) gin.HandlerFunc {
 			}
 			row := gin.H{
 				"Id":                    sess.ID,
-				"ServerId":              "mediastation-go-001",
+				"ServerId":              "mmtl-001",
 				"Client":                sess.Client,
 				"DeviceId":              sess.DeviceID,
 				"DeviceName":            sess.DeviceName,

internal/handler/emby_sessions_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestEmbySessionsReturnsRealtimeSession(t *testing.T) {

internal/handler/emby_static.go

@@ -7,7 +7,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/gorilla/websocket"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func embyNoContentHandler(_ *service.Container) gin.HandlerFunc {

internal/handler/emby_subtitle_routes_test.go

@@ -14,10 +14,10 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // TestEmbySubtitleOfficialRouteServesRawASS verifies that the official Emby
@@ -75,7 +75,7 @@ func TestEmbySubtitleOfficialRouteServesRawASS(t *testing.T) {
 	registerEmbyRoutes(router, secret, &service.Container{
 		Repo: repos,
 		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos).SetSubtitleService(
-			service.NewSubtitleService(zap.NewNop(), repos),
+			service.NewSubtitleService(&config.Config{}, zap.NewNop(), repos),
 		),
 	})
 
@@ -150,7 +150,7 @@ func TestEmbySubtitleDeliveryUrlGetsToken(t *testing.T) {
 	registerEmbyRoutes(router, secret, &service.Container{
 		Repo: repos,
 		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos).SetSubtitleService(
-			service.NewSubtitleService(zap.NewNop(), repos),
+			service.NewSubtitleService(&config.Config{}, zap.NewNop(), repos),
 		),
 	})
 

internal/handler/emby_system.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func embySystemInfoHandler(svc *service.Container) gin.HandlerFunc {
@@ -84,9 +84,9 @@ func embyPublicSystemInfoPayload(c *gin.Context, svc *service.Container) map[str
 		return embyWithRequestAddress(c, svc.Emby.SystemInfoPublic())
 	}
 	return embyWithRequestAddress(c, map[string]any{
-		"Id":                     "mediastation-go-001",
-		"ServerId":               "mediastation-go-001",
-		"ServerName":             "MediaStationGo",
+		"Id":                     "mmtl-001",
+		"ServerId":               "mmtl-001",
+		"ServerName":             "MMTL",
 		"Version":                "4.8.10.0",
 		"ServerVersion":          "4.8.10.0",
 		"ProductName":            "Emby Server",

internal/handler/emby_test_helpers_test.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/golang-jwt/jwt/v5"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/middleware"
 )
 
 func signedTestToken(t *testing.T, secret string) string {
@@ -23,7 +23,7 @@ func signedTestTokenWithPurpose(t *testing.T, secret, purpose string) string {
 		Purpose: purpose,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
-			Issuer:    "mediastationgo-test",
+			Issuer:    "mmtl-test",
 			Subject:   "user-1",
 		},
 	}

internal/handler/emby_users.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // ─── Users / Auth ────────────────────────────────────────────────────────────
@@ -67,7 +67,7 @@ func embyAuthByNameHandler(svc *service.Container) gin.HandlerFunc {
 		embyRememberCompatSession(c, accessToken)
 		c.JSON(http.StatusOK, gin.H{
 			"AccessToken": accessToken,
-			"ServerId":    "mediastation-go-001",
+			"ServerId":    "mmtl-001",
 			"User":        userPayload,
 			"SessionInfo": gin.H{
 				"Id":         resp.User.ID,
@@ -150,12 +150,12 @@ func embyGetUserByIDHandler(svc *service.Container) gin.HandlerFunc {
 
 func embyFallbackUser(id string) gin.H {
 	if strings.TrimSpace(id) == "" {
-		id = "mediastation-user"
+		id = "mmtl-user"
 	}
 	return gin.H{
 		"Id":                        id,
-		"Name":                      "MediaStationGo",
-		"ServerId":                  "mediastation-go-001",
+		"Name":                      "MMTL",
+		"ServerId":                  "mmtl-001",
 		"HasPassword":               true,
 		"HasConfiguredPassword":     true,
 		"HasConfiguredEasyPassword": false,

internal/handler/emby_views_handlers.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func embyViewsHandler(svc *service.Container) gin.HandlerFunc {

internal/handler/filemanager.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 type fileFolderReq struct {

internal/handler/handler.go

@@ -8,8 +8,8 @@ import (
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // Register attaches every API route to the engine.
@@ -46,7 +46,7 @@ func healthCheck(c *gin.Context) {
 }
 
 func versionInfo(c *gin.Context) {
-	c.JSON(200, gin.H{"name": "MediaStationGo", "version": "0.1.0"})
+	c.JSON(200, gin.H{"name": "MMTL", "version": "0.1.0"})
 }
 
 // ─── 权限 Handler 包装 ────────────────────────────────────────────────────────

internal/handler/manual_scrape.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 type manualScrapeApplyReq struct {

internal/handler/media.go

@@ -10,18 +10,19 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 type createLibraryReq struct {
-	Name     string                     `json:"name" binding:"required"`
-	Path     string                     `json:"path"`
-	Paths    []string                   `json:"paths"`
-	Roots    []service.LibraryRootInput `json:"roots"`
-	Type     string                     `json:"type"`
-	CoverURL string                     `json:"cover_url"`
+	Name              string                     `json:"name"`
+	Path              string                     `json:"path"`
+	Paths             []string                   `json:"paths"`
+	Roots             []service.LibraryRootInput `json:"roots"`
+	Type              string                     `json:"type"`
+	CoverURL          string                     `json:"cover_url"`
+	CreatePerSubfolder bool                      `json:"create_per_subfolder"`
 }
 
 func listLibrariesHandler(svc *service.Container) gin.HandlerFunc {
@@ -32,7 +33,7 @@ func listLibrariesHandler(svc *service.Container) gin.HandlerFunc {
 			return
 		}
 		role, _ := c.Get(middleware.CtxUserRole)
-		includeHidden := role == "admin" && (c.Query("include_hidden") == "1" || c.Query("all") == "1")
+		includeHidden := role == "admin" && (c.Query("include_hidden") == "1" || c.Query("include_hidden") == "true" || c.Query("all") == "1")
 		if !includeHidden {
 			libs = service.FilterDisplayCloudLibraries(c.Request.Context(), svc.Repo, libs)
 			visibility := mediaVisibilityForRequest(c, svc)
@@ -44,6 +45,22 @@ func listLibrariesHandler(svc *service.Container) gin.HandlerFunc {
 			}
 			libs = filtered
 		}
+		withPreview := c.Query("with_preview") == "1" || c.Query("with_preview") == "true"
+		if withPreview {
+			limit, _ := strconv.Atoi(c.DefaultQuery("preview_limit", c.DefaultQuery("limit", "10")))
+			if limit <= 0 {
+				limit = 10
+			} else if limit > 100 {
+				limit = 100
+			}
+			previews, err := svc.Media.ListLibrariesWithPreview(c.Request.Context(), libs, mediaVisibilityForRequest(c, svc), limit)
+			if err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+			c.JSON(http.StatusOK, previews)
+			return
+		}
 		c.JSON(http.StatusOK, libs)
 	}
 }
@@ -60,7 +77,7 @@ func getLibraryHandler(svc *service.Container) gin.HandlerFunc {
 			return
 		}
 		role, _ := c.Get(middleware.CtxUserRole)
-		includeHidden := role == "admin" && (c.Query("include_hidden") == "1" || c.Query("all") == "1")
+		includeHidden := role == "admin" && (c.Query("include_hidden") == "1" || c.Query("include_hidden") == "true" || c.Query("all") == "1")
 		if !includeHidden {
 			libs := service.FilterDisplayCloudLibraries(c.Request.Context(), svc.Repo, []model.Library{*lib})
 			if len(libs) == 0 || !service.LibraryVisibleForUser(c.Request.Context(), svc.Repo, libs[0], mediaVisibilityForRequest(c, svc)) {
@@ -88,9 +105,38 @@ func createLibraryHandler(svc *service.Container) gin.HandlerFunc {
 			}
 		}
 		if len(roots) == 0 && strings.TrimSpace(req.Path) != "" {
-			roots = append(roots, service.LibraryRootInput{Path: req.Path})
+roots = append(roots, service.LibraryRootInput{Path: req.Path})
+	}
+	var l *model.Library
+	if req.CreatePerSubfolder {
+		parent := ""
+		if len(roots) > 0 {
+			parent = roots[0].Path
+		} else if strings.TrimSpace(req.Path) != "" {
+			parent = req.Path
 		}
-		l, err := svc.Media.CreateLibraryWithRootsAndCover(c.Request.Context(), req.Name, req.Type, req.CoverURL, roots)
+		created, err := svc.Media.CreateLibrariesPerSubfolder(c.Request.Context(), parent, req.Type, req.CoverURL)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		uid, _ := c.Get("ctx_user_id")
+		for i := range created {
+			lib := &created[i]
+			svc.Audit.Record(c.Request.Context(), toString(uid), "library.create", lib.ID, c.ClientIP(), lib.Path)
+			if svc.Watcher != nil {
+				go func() { _ = svc.Watcher.Refresh(context.Background()) }()
+			}
+			for _, root := range lib.Roots {
+				if root.Enabled {
+					queueLibraryRootScan(svc, lib.ID, root.ID)
+				}
+			}
+		}
+		c.JSON(http.StatusCreated, gin.H{"libraries": created})
+		return
+	}
+	l, err := svc.Media.CreateLibraryWithRootsAndCover(c.Request.Context(), req.Name, req.Type, req.CoverURL, roots)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
@@ -117,7 +163,9 @@ func createLibraryHandler(svc *service.Container) gin.HandlerFunc {
 }
 
 type updateLibraryReq struct {
-	CoverURL string `json:"cover_url"`
+	CoverURL        *string `json:"cover_url"`
+	SortOrder       *int    `json:"sort_order"`
+	CarouselEnabled *bool   `json:"carousel_enabled"`
 }
 
 func updateLibraryHandler(svc *service.Container) gin.HandlerFunc {
@@ -127,9 +175,17 @@ func updateLibraryHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
-		if err := svc.Media.UpdateLibraryCover(c.Request.Context(), c.Param("id"), req.CoverURL); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-			return
+		if req.CoverURL != nil {
+			if err := svc.Media.UpdateLibraryCover(c.Request.Context(), c.Param("id"), *req.CoverURL); err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+		}
+		if req.SortOrder != nil || req.CarouselEnabled != nil {
+			if err := svc.Media.UpdateLibraryFields(c.Request.Context(), c.Param("id"), req.SortOrder, req.CarouselEnabled); err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
 		}
 		lib, err := svc.Repo.Library.FindByID(c.Request.Context(), c.Param("id"))
 		if err != nil || lib == nil {
@@ -140,6 +196,25 @@ func updateLibraryHandler(svc *service.Container) gin.HandlerFunc {
 	}
 }
 
+type reorderLibrariesReq struct {
+	IDs []string `json:"ids" binding:"required"`
+}
+
+func reorderLibrariesHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req reorderLibrariesReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		if err := svc.Media.ReorderLibraries(c.Request.Context(), req.IDs); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"updated": len(req.IDs)})
+	}
+}
+
 func deleteLibraryHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")

internal/handler/media_extra.go

@@ -8,8 +8,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func recentMediaHandler(svc *service.Container) gin.HandlerFunc {

internal/handler/media_favorite.go

@@ -12,9 +12,9 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 // addMediaFavoriteHandler ensures the (user, media) row exists. If it

internal/handler/media_roots.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func listLibraryRootsHandler(svc *service.Container) gin.HandlerFunc {

internal/handler/media_scan.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func scanLibraryHandler(svc *service.Container) gin.HandlerFunc {

internal/handler/media_test.go

@@ -18,11 +18,11 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
-	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
-	"github.com/ShukeBta/MediaStationGo/internal/model"
-	"github.com/ShukeBta/MediaStationGo/internal/repository"
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/config"
+	"github.com/ShukeBta/MMTL/internal/middleware"
+	"github.com/ShukeBta/MMTL/internal/model"
+	"github.com/ShukeBta/MMTL/internal/repository"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func TestQueueLibraryRootScanImportsNewLibraryMedia(t *testing.T) {

internal/handler/metadata_enrich.go

@@ -8,7 +8,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 var metadataNoiseRE = regexp.MustCompile(`(?i)(自动订阅|订阅|全集|合集|complete|batch|season\s*\d+|s\d{1,2}|s\d{1,2}e\d{1,3}|第\s*\d+\s*季|第\s*\d+\s*[集话話期]|2160p|1080p|720p|4k|uhd|bluray|blu-ray|web-?dl|hdtv|remux|x26[45]|h\.?26[45]|hevc|avc|hdr10?\+?|dovi|dv|atmos|aac|ddp?5\.1|truehd|flac)`)

internal/handler/nfo.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/ShukeBta/MediaStationGo/internal/service"
+	"github.com/ShukeBta/MMTL/internal/service"
 )
 
 func exportNFOHandler(svc *service.Container) gin.HandlerFunc {