fix: proxy cover art through server to satisfy CSP img-src 'self'
The new CSP blocks direct browser requests to external image origins
(themoviedb.org, thetvdb.com, etc.) used for poster art.
- dashboard.js: add GET /api/dashboard/cover-art?url=... proxy endpoint
(auth-required, http/https only, image content-type validated, 5MB cap,
24h Cache-Control, streams response directly to client)
- app.js: route coverArt src through /api/dashboard/cover-art proxy
- server/utils/logger.js: fix hardcoded /app/server.log path (use DATA_DIR)
Gronod
cc1e8af761
