merge: 合并 upstream/main 并保留本地图片计费功能

backend/internal/util/urlvalidator/validator_test.go

+package urlvalidator
+
+import "testing"
+
+func TestValidateURLFormat(t *testing.T) {
+	if _, err := ValidateURLFormat("", false); err == nil {
+		t.Fatalf("expected empty url to fail")
+	}
+	if _, err := ValidateURLFormat("://bad", false); err == nil {
+		t.Fatalf("expected invalid url to fail")
+	}
+	if _, err := ValidateURLFormat("http://example.com", false); err == nil {
+		t.Fatalf("expected http to fail when allow_insecure_http is false")
+	}
+	if _, err := ValidateURLFormat("https://example.com", false); err != nil {
+		t.Fatalf("expected https to pass, got %v", err)
+	}
+	if _, err := ValidateURLFormat("http://example.com", true); err != nil {
+		t.Fatalf("expected http to pass when allow_insecure_http is true, got %v", err)
+	}
+	if _, err := ValidateURLFormat("https://example.com:bad", true); err == nil {
+		t.Fatalf("expected invalid port to fail")
+	}
+}

backend/migrations/028_add_account_notes.sql

+-- 028_add_account_notes.sql
+-- Add optional admin notes for accounts.
+
+ALTER TABLE accounts
+ADD COLUMN IF NOT EXISTS notes TEXT;
+
+COMMENT ON COLUMN accounts.notes IS 'Admin-only notes for account';

frontend/.npmrc

+legacy-peer-deps=true
+# 允许运行所有包的构建脚本
+# esbuild 和 vue-demi 是已知安全的包，需要 postinstall 脚本才能正常工作
+ignore-scripts=false