phsl / new-api

- Add ValidateURLWithFetchSetting check before fetching MJ image URLs
  in RelayMidjourneyImage (unauthenticated endpoint)
- Add ValidateURLWithFetchSetting check before fetching video URLs
  in VideoProxy (upstream-controlled URL)
- Enable ApplyIPFilterForDomain by default to prevent DNS rebinding
  bypass of SSRF protection
- Elevate FetchModels endpoint from AdminAuth to RootAuth
- Update frontend: mark domain IP filtering as recommended, update
  description and i18n translations (zh-CN/zh-TW/en/fr/ja/ru/vi)

- Add StreamStatus type (relay/common) to track stream end reason
  (done/timeout/client_gone/scanner_error/eof/panic/ping_fail) and
  accumulate soft errors during streaming via sync.Once + sync.Mutex.
- Add StreamResult (relay/helper) as the callback interface: adapters
  call sr.Error() for soft errors, sr.Stop() for fatal, sr.Done() for
  normal completion. No early-return problem — multiple errors per chunk
  are naturally supported.
- Refactor StreamScannerHandler callback from func(string) bool to
  func(string, *StreamResult). All 9 channel adapters updated.
- Write stream_status into log other JSON field (admin-only) with
  status ok/error, end_reason, error_count, and error messages.
- Frontend: display stream status in log detail expansion for admins.

chore(deps): bump golang.org/x/image from 0.23.0 to 0.38.0

Bumps [golang.org/x/image](https://github.com/golang/image) from 0.23.0 to 0.38.0.
- [Commits](https://github.com/golang/image/compare/v0.23.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.38.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

feat: prevent metadata from overriding model fields

refactor: expose skip-retry option and show it in rules list

fix: restore pre-3400 OpenRouter billing semantics

fix: restore doubao coding plan deprecation and regex ignored models lost during conflict resolution

# Conflicts:
#	web/src/components/table/channels/modals/EditChannelModal.jsx

- Pin all GitHub Actions to commit SHA to prevent supply chain attacks
- Enable SLSA provenance attestation (mode=max) and SBOM generation
- Add cosign keyless signing for Docker images via GitHub OIDC
- Capture and output image digests to GitHub Job Summary
- Pin Dockerfile base images to digest (bun:1, golang:1.26.1-alpine, debian:bookworm-slim)
- Add SHA256 checksum generation for binary releases (Linux/macOS/Windows)
- Update actions/checkout v3->v4, actions/setup-go v3->v5 in release.yml

fix: the "detail" field is empty, an empty field was sent to upstream

refactor: optimize billing flow for OpenAI-to-Anthropic convert

Refactor/codex usage

fix: apply forced beta query at final upstream URL stage

fix: honor channel affinity skip-retry when channel is disabled

adjuct default settings

feat: support regex-prefixed ignored upstream models

fix: oauth bind callback handling

fix: disable doubao coding plan selection

docs: 完善宝塔面板部署教程并修复链接错误

feat: Add support for counting cache-hit tokens in llama.cpp

feat: add server log file management to performance settings

- Fix data race on gin.DefaultWriter during log rotation by adding LogWriterMu
- Report partial failure when some log files fail to delete instead of always returning success
- Fix misleading "logging disabled" banner shown before API responds
- Fix en.json translation for numeric validation message

Add API endpoints (GET/DELETE /api/performance/logs) to list and clean up
server log files by count or by age. Track the active log file path in
the logger to prevent deleting the currently open log. Add a management
UI section in the performance settings page with log directory info,
file statistics, and cleanup controls. Includes i18n translations for
all supported languages (en, fr, ja, ru, vi, zh-CN, zh-TW).