fix(markdown): resolve media previews under sign_all

[LinYu369]

Summary / 摘要

Fixes two markdown preview problems: images return 401 when sign_all is
enabled (the generated /d/ links carry no sign), and videos never render at
all (image-syntax video links become <img>, and the sanitize schema strips
<video> elements entirely).

修复两个 md 预览问题：开启 sign_all 后图片链接不带签名导致 401；视频完全不显示（图片语法指向视频被转成 <img>，且 sanitize 白名单会整体剥离 <video> 元素）。

• User-visible changes / 用户可感知的行为变化:

  • Markdown images now load correctly when sign_all is enabled.
  • Videos in markdown (![](file.mp4) or raw <video> tags) now render and play.
  • Media in shared-page markdown previews also works (backend routes /@s paths to the share API automatically).
  • External image links are untouched.

• Implementation changes / 重要实现变化:

  • After render, fixMediaSrc rewrites relative src of img/video/audio/source to signed raw urls obtained via fs/get (with caching, failure retry and a bounded concurrency pool).
  • ![]() links pointing to video files are rewritten to <video controls> elements.
  • The sanitize schema now allows video/audio/track elements and media attributes (they were previously stripped entirely).
  • Local media links are recognized by origin and the deployment base_path is stripped before resolving the storage path.
  • Removed a leftover console.log debug statement.

• Config / storage / API / compatibility: none.
  / 无配置、存储、API 或兼容性变化。

• This PR has breaking changes.
  / 此 PR 包含破坏性变更。

• This PR changes public API, config, storage format, or migration behavior.
  / 此 PR 修改了公开 API、配置、存储格式或迁移行为。

• This PR requires corresponding changes in related repositories.
  / 此 PR 需要关联仓库同步修改。

Related repository PRs / 关联仓库 PR:

• OpenList: N/A
• OpenList-Docs: N/A

Related Issues / 关联 Issue

N/A（无关联 Issue，本节可删除）

Testing / 测试

• go test ./... — N/A, this is a frontend-only repository.
  / 不适用，本仓库为纯前端仓库，无 Go 代码。
• pnpm lint (tsc --noEmit) — no errors in the changed file; the remaining errors are pre-existing and unrelated to this PR.
  / 变更文件无类型错误；其余报错为与本 PR 无关的既有问题。
• pnpm build — succeeds.
• Manual test / 手动测试:
  • Environment: OpenList-Desktop v4.2.4 (backend) serving this dist, with sign_all = true.
  • Markdown images display correctly; Network tab shows POST /api/fs/get returning a signed raw_url, and image requests hit /p/...?sign=... with 200.
  • ![](xxx.mp4) renders as a playable <video> with controls.
  • Raw <video src="..." controls> tags play as well.
  • External (http(s) other-origin) images are unaffected.
  • Share-page previews: covered by the same code path (backend routes /@s to the share API), not manually verified — please double-check with a share link if possible.
    / 分享页预览未手动验证（代码路径与普通预览一致），建议维护者用分享链接补充验证。

修复前

修复后的效果

测试用的md代码，媒体和md是在同一个目录下

## 2026-08 测试md
2026-08-16 05:04 
测试111

<video src="测试视频1.mp4" controls></video>
979 Likes, 92 Retweets, 1 Replies


2022-04-02 04:34 [src]

测试222
[![](2022-05-03-08-20-img_16.jpg)]
411 Likes, 20 Retweets, 7 Replies

测试
[![](2022-05-03-08-20-img_17.jpg)]
411 Likes, 20 Retweets, 7 Replies

Checklist / 检查清单

• I have read CONTRIBUTING.
  / 我已阅读 CONTRIBUTING。
• I confirm this contribution follows the repository license, contribution policy, and code of conduct.
  / 我确认此贡献符合仓库许可证、贡献规范和行为准则。
• I have formatted the changed code with gofmt, go fmt, or prettier where applicable.
  / 变更代码遵循项目 prettier 风格（与现有文件一致；本地未运行 prettier 命令）。
• I have requested review from relevant maintainers or code owners where applicable.
  / 不适用（未请求维护者审查）。

AI Disclosure / AI 使用声明

This PR includes AI-assisted content (code generation) produced with Qoder (Lingma). The core fix was manually verified end-to-end (images and videos render correctly with sign_all enabled).

此 PR 包含使用 Qoder (Lingma) 生成的 AI 辅助内容（代码生成），核心修复已端到端手动验证（sign_all 开启时图片、视频均可正常预览）。

• This PR includes AI-assisted content.
  / 此 PR 包含 AI 辅助内容。

Tools used / 使用工具:

• ChatGPT
• Codex
• GitHub Copilot
• Claude
• Gemini
• Other (please specify) / 其他（请注明）: Qoder (Lingma)

Usage scope / 使用范围:

• Code generation / 代码生成

• Refactoring / 重构

• Documentation / 文档

• Tests / 测试

• Translation / 翻译

• Review assistance / 审查辅助

• I have reviewed and validated all AI-assisted content included in this PR.
  / 我已审核并验证此 PR 中的所有 AI 辅助内容。

• I have ensured that all AI-assisted commits include Co-Authored-By attribution.
  / 我已确保所有 AI 辅助提交都包含 Co-Authored-By 归属信息。（当前 commit 未包含，见下方说明）

• I can reproduce all AI-assisted content included in this PR without any AI tools.
  / 我可以在没有任何 AI 工具的情况下重现此 PR 中包含的所有 AI 辅助内容。（无法勾选，如实声明）