feat: storage path layout, basename URLs, and bidirectional domain isolation

Add storage_use_date_path for flat vs date-key storage layout and emit
basename-only public URLs when hide-folder is enabled. Block image paths
on the site host when domain separation is active so only the image host
serves files. Update settings UI, i18n, tests, and deployment docs.

server/utils/db.ts

@@ -374,6 +374,7 @@ export const SETTINGS_API_UPLOAD_TOKEN = 'api_upload_token'
 export const SETTINGS_WEBP_QUALITY = 'webp_quality'
 export const SETTINGS_ALLOWED_REFERER_HOSTS = 'allowed_referer_hosts'
 export const SETTINGS_HIDE_FOLDER_IN_URL = 'hide_folder_in_url'
+export const SETTINGS_STORAGE_USE_DATE_PATH = 'storage_use_date_path'
 export const SETTINGS_SITE_BASE_URL = 'site_base_url'
 export const SETTINGS_IMAGE_BASE_URL = 'image_base_url'
 export const SETTINGS_AUTO_DELETE_DAYS = 'auto_delete_days'