feat: storage path layout, basename URLs, and bidirectional domain isolation

Add storage_use_date_path for flat vs date-key storage layout and emit
basename-only public URLs when hide-folder is enabled. Block image paths
on the site host when domain separation is active so only the image host
serves files. Update settings UI, i18n, tests, and deployment docs.

server/utils/image-public-path.ts

@@ -1,13 +1,21 @@
-/** 对外 URL 路径：可选去掉 key 的首段目录（如 images/） */
+import { basename } from 'node:path'
+
+/** 对外 URL 路径：可选隐藏目录前缀（输出纯文件名） */
 export function toPublicImagePath(key: string, hideFolder: boolean): string {
   if (!hideFolder) return key
-  const slash = key.indexOf('/')
-  return slash > 0 ? key.slice(slash + 1) : key
+  return basename(key)
 }
 
 const HIDDEN_DATE_PATH_PATTERN
   = /^\d{4}\/\d{2}\/[^/\\]+\.(jpg|jpeg|png|webp|gif|svg|ico)$/i
 
+const BARE_FILENAME_PATTERN
+  = /^[^/\\]+\.(jpg|jpeg|png|webp|gif|svg|ico)$/i
+
 export function isHiddenImageDatePath(path: string): boolean {
   return HIDDEN_DATE_PATH_PATTERN.test(path)
 }
+
+export function isBareImageFilename(path: string): boolean {
+  return BARE_FILENAME_PATTERN.test(path)
+}