fix: add cover-proxy internal URL rewrite patch for node jail isolation

Node jail has no outbound internet — cover-proxy must rewrite
audio.giersig.eu/media/* fetches to http://10.100.0.10:8091/media/*
using the new mediaInternalUrl config option.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/patch-listening-endpoint-runtime-guards.mjs

@@ -778,6 +778,33 @@ const patchSpecs = [
       "node_modules/@indiekit/indiekit/node_modules/@rmdes/indiekit-endpoint-funkwhale/index.js",
     ],
   },
+  {
+    name: "funkwhale-cover-proxy-internal-url-rewrite",
+    marker: "Rewrite media URLs to internal endpoint when node jail can't reach public hostname",
+    oldSnippet: `      try { urlObj = new URL(rawUrl); } catch { return response.status(400).send("Invalid url"); }
+      try {
+        const upstream = await fetch(rawUrl, {`,
+    newSnippet: `      try { urlObj = new URL(rawUrl); } catch { return response.status(400).send("Invalid url"); }
+
+      // Rewrite media URLs to internal endpoint when node jail can't reach public hostname
+      let fetchUrl = rawUrl;
+      const { funkwhaleConfig } = request.app.locals.application;
+      if (funkwhaleConfig?.mediaInternalUrl && funkwhaleConfig?.instanceUrl) {
+        try {
+          const instanceHost = new URL(funkwhaleConfig.instanceUrl).hostname;
+          if (urlObj.hostname === instanceHost) {
+            fetchUrl = funkwhaleConfig.mediaInternalUrl.replace(/\\/+$/, "") + urlObj.pathname + urlObj.search;
+          }
+        } catch {}
+      }
+
+      try {
+        const upstream = await fetch(fetchUrl, {`,
+    candidates: [
+      "node_modules/@rmdes/indiekit-endpoint-funkwhale/index.js",
+      "node_modules/@indiekit/indiekit/node_modules/@rmdes/indiekit-endpoint-funkwhale/index.js",
+    ],
+  },
 ];
 
 async function exists(filePath) {