feat: storage path layout, basename URLs, and bidirectional domain isolation

Add storage_use_date_path for flat vs date-key storage layout and emit
basename-only public URLs when hide-folder is enabled. Block image paths
on the site host when domain separation is active so only the image host
serves files. Update settings UI, i18n, tests, and deployment docs.

server/utils/serve-image-path.test.ts

@@ -2,6 +2,11 @@ import { describe, expect, it } from 'vitest'
 import { requestPathToImageKey } from './serve-image'
 
 describe('requestPathToImageKey hide folder', () => {
+  it('resolves bare filename to default folder flat key', () => {
+    expect(requestPathToImageKey('/demo.webp', { hideFolder: true }))
+      .toBe('images/demo.webp')
+  })
+
   it('resolves hidden date path to default folder key', () => {
     expect(requestPathToImageKey('/2026/08/demo.webp', { hideFolder: true }))
       .toBe('images/2026/08/demo.webp')
@@ -10,10 +15,19 @@ describe('requestPathToImageKey hide folder', () => {
   it('still accepts full key when hide folder is enabled', () => {
     expect(requestPathToImageKey('/images/2026/08/demo.webp', { hideFolder: true }))
       .toBe('images/2026/08/demo.webp')
+    expect(requestPathToImageKey('/images/demo.webp', { hideFolder: true }))
+      .toBe('images/demo.webp')
   })
 
-  it('does not resolve hidden path when hide folder is disabled', () => {
+  it('does not resolve short paths when hide folder is disabled', () => {
     expect(requestPathToImageKey('/2026/08/demo.webp', { hideFolder: false }))
       .toBeNull()
+    expect(requestPathToImageKey('/demo.webp', { hideFolder: false }))
+      .toBeNull()
+  })
+
+  it('accepts flat full key when hide folder is disabled', () => {
+    expect(requestPathToImageKey('/images/demo.webp', { hideFolder: false }))
+      .toBe('images/demo.webp')
   })
 })