feat: storage path layout, basename URLs, and bidirectional domain isolation

Add storage_use_date_path for flat vs date-key storage layout and emit
basename-only public URLs when hide-folder is enabled. Block image paths
on the site host when domain separation is active so only the image host
serves files. Update settings UI, i18n, tests, and deployment docs.

i18n/locales/en.json

@@ -180,6 +180,7 @@
     "title": "System settings",
     "subtitle": "Saved to database; environment variables take precedence",
     "uploadAccount": "Upload & accounts",
+    "featureToggles": "Feature toggles",
     "defaultFolder": "Default upload folder",
     "defaultFolderHint": "Stored in this browser only; affects your upload target",
     "allowRegistration": "Open registration",
@@ -188,6 +189,8 @@
     "refererHint": "Referer hotlink protection; comma-separated hostnames, empty = no restriction",
     "refererPlaceholder": "example.com, www.example.com",
     "linkGeneration": "Domains & links",
+    "domainSettings": "Domain settings",
+    "storagePathSettings": "Storage paths & direct links",
     "domainSeparationActive": "Domain separation enabled: image host serves images only; site host serves admin and API",
     "siteBaseUrl": "Site URL",
     "siteBaseUrlHint": "No trailing slash; admin UI, API docs, and Twikoo upload endpoint",
@@ -199,10 +202,12 @@
     "imageBaseUrlPlaceholder": "https://pic.example.com",
     "imageBaseUrlActive": "Active: {url}",
     "hideFolderInUrl": "Hide folder in image URLs",
-    "hideFolderInUrlHint": "Links become /2026/08/file.webp without the images/ prefix; legacy full paths still work",
+    "hideFolderInUrlHint": "Links become /file.webp without folder or date paths; legacy full paths still work",
     "hideFolderConfirmTitle": "Hide folder prefix in URLs?",
-    "hideFolderConfirmDesc": "If two folders share the same year/month/filename (e.g. images/2026/08/a.webp and blog/2026/08/a.webp), the short URL /2026/08/a.webp resolves to the images folder first—you may get the wrong file. Enable only with a single upload folder or globally unique filenames.",
+    "hideFolderConfirmDesc": "If two folders share the same filename (e.g. images/a.webp and blog/a.webp), the short URL /a.webp resolves to the images folder first—you may get the wrong file. Enable only with a single upload folder or globally unique filenames.",
     "hideFolderConfirmEnable": "Enable anyway",
+    "storageUseDatePath": "Group uploads by year/month",
+    "storageUseDatePathHint": "When enabled, files are stored as images/2026/08/file.webp; when disabled, as images/file.webp. Applies only to new uploads after enabling",
     "badgeEnv": ".env",
     "badgeSaved": "Saved",
     "badgeDefault": "Default",

i18n/locales/zh-CN.json

@@ -180,6 +180,7 @@
     "title": "系统设置",
     "subtitle": "保存后写入数据库；环境变量优先级更高",
     "uploadAccount": "上传与账号",
+    "featureToggles": "功能开关",
     "defaultFolder": "默认上传目录",
     "defaultFolderHint": "保存在本机浏览器，仅影响您的上传目标目录",
     "allowRegistration": "开放用户注册",
@@ -188,6 +189,8 @@
     "refererHint": "Referer 防盗链，逗号分隔允许引用的域名，留空不限制",
     "refererPlaceholder": "example.com, www.example.com",
     "linkGeneration": "域名与链接",
+    "domainSettings": "域名配置",
+    "storagePathSettings": "存储路径与直链",
     "domainSeparationActive": "已启用域名分离：图片域仅出图，管理域提供后台与 API",
     "siteBaseUrl": "网站域名",
     "siteBaseUrlHint": "末尾不加 /；管理后台、API 文档与 Twikoo 上传地址",
@@ -199,10 +202,12 @@
     "imageBaseUrlPlaceholder": "https://pic.example.com",
     "imageBaseUrlActive": "当前生效：{url}",
     "hideFolderInUrl": "隐藏直链目录前缀",
-    "hideFolderInUrlHint": "开启后链接为 /2026/08/xxx.webp，不含 images/ 等目录名；旧链接仍可用",
+    "hideFolderInUrlHint": "开启后直链为 /xxx.webp，不含 images/ 或日期路径；旧链接仍可用",
     "hideFolderConfirmTitle": "确认隐藏目录前缀？",
-    "hideFolderConfirmDesc": "开启后不同目录下若存在相同年月与文件名（如 images/2026/08/a.webp 与 blog/2026/08/a.webp），短链接 /2026/08/a.webp 将优先解析到 images 目录，可能访问到非预期的图片。仅单一上传目录或文件名全局唯一时建议开启。",
+    "hideFolderConfirmDesc": "开启后不同目录下若存在相同文件名（如 images/a.webp 与 blog/a.webp），短链接 /a.webp 将优先解析到 images 目录，可能访问到非预期的图片。仅单一上传目录或文件名全局唯一时建议开启。",
     "hideFolderConfirmEnable": "仍要开启",
+    "storageUseDatePath": "上传目录按年/月分组",
+    "storageUseDatePathHint": "开启后保存为 images/2026/08/xxx.webp；关闭则为 images/xxx.webp。仅影响启用后的新上传",
     "badgeEnv": ".env",
     "badgeSaved": "已保存",
     "badgeDefault": "默认",