fix(proxy): add path validation guardrail to imageproxy

[RinZ27]

Description

This PR adds a path validation guardrail to the imageproxy route. It prevents the processing of protocol-relative URLs (starting with //) or absolute URLs (containing ://).

While the underlying ImageProxy logic uses a baseURL, this additional check ensures that malformed or malicious paths that might attempt to bypass the intended destination are blocked early at the routing level.

How Has This Been Tested?

Verified that standard image proxying for TMDB and TVDB remains functional. Confirmed that requests with absolute or protocol-relative paths in the imagePath parameter are now correctly caught and return a 403 Forbidden response, with a corresponding error logged.

Checklist:

• I have read and followed the contribution guidelines.
• Disclosed any use of AI: This PR was prepared with the assistance of an AI agent.
• I have updated the documentation accordingly.
• All new and existing tests passed.
• Successful build pnpm build
• Translation keys pnpm i18n:extract
• Database migration (if required)

Summary by CodeRabbit

• Bug Fixes
  • Strengthened image proxy security by adding validation to detect and block potentially malicious image requests that try to reference external or malformed resources. Such requests are now rejected with an appropriate forbidden response, preventing unintended access and improving overall safety.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

---

📝 Walkthrough

Walkthrough

Adds a pre-check to the image proxy route that rejects requests where the constructed imagePath begins with // or contains ://, logging the event and returning HTTP 403 Forbidden to block potential SSRF.

Changes

Cohort / File(s)	Summary
SSRF Protection Guard server/routes/imageproxy.ts	Added validation that detects imagePath values starting with // or containing ://; such requests are logged as SSRF attempts and responded to with 403 Forbidden. No other control-flow changes.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 I sniff the paths both near and far,
If // or :// I find a scar,
I sound the bell, the gate stays shut,
Forbidden now — no sneaky cut,
Safe hops onward, guard on guard. ✨

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: add path validation guardrail to imageproxy' clearly and specifically describes the main change: adding a path validation guardrail to the imageproxy route, which matches the PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR adds SSRF (Server-Side Request Forgery) protection to the imageproxy route by validating that incoming image paths do not contain protocol-relative URLs (//) or absolute URLs (://) that could bypass the intended base URLs for TMDB and TVDB image proxying.

Changes:

• Added path validation check to detect and block potentially malicious URL patterns
• Returns 403 Forbidden with error logging when SSRF attempt is detected

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[RinZ27]

I actually kept it as "Potential SSRF" during the initial pass to explicitly flag the security intent for the review process, otherwise I would've stuck with the functional naming from the start. Glad we're on the same page that "Invalid URL" is better for the production logs. Updated!