fix: serve media again by unsetting download-proxy and scoping Host per request

Two independent faults made every image fail while pages still rendered.

config.example.json shipped download-proxy=http://127.0.0.1:8080. Only media
fetches go through that proxy — pages reach DeviantArt via devianter on the
default transport — so when nothing listens there, images 502 and the rest of
the page looks fine. In a scratch container 127.0.0.1 is the container itself,
so the default could never work under Docker. Unset it and document that it must
stay empty unless an operator really runs a proxy.

Host was a package global reassigned by every request, so a concurrent request
could overwrite it mid-render and emit URLs on another origin's host and port.
The instance's own default-src 'self' CSP then blocked those images. Thread the
request's host through skunkyart instead, and take it as an explicit argument in
URLBuilder, ParseMedia, ParseDescription, BuildUserPlate and
ConvertDeviantArtURLToSkunkyArt. Feeds keep their absolute URLs.

Also start RefreshInstances after ExecuteConfig rather than before it: the
goroutine read CFG while json.Unmarshal was writing it (a race the detector
flags), and its fetch escaped both the throttle and the configured User-Agent.

Verified: 300 concurrent requests with distinct Host headers now round-trip
their own host (was 1 leak per 300), go test -race is clean, and
cache+proxy both enabled serves 200 image/jpeg cold and from cache.

1 files changed, 10 insertions, 1 deletions

diff --git a/SETUP.md b/SETUP.md
index 12622a2..4cb8aa8 100755
--- a/SETUP.md
+++ b/SETUP.md
@@ -17,8 +17,17 @@ Time units:
   * `max-size` — Maximum file size in megabytes
   * `update-interval` — Automatic rotation interval
 * `static-path` — This setting determines path to static, which will be copied to RAM when SkunkyArt is started. Useless if you're use binary compiled with 'embed' tag.
-* `download-proxy` — Proxy address for downloading files.
+* `download-proxy` — Outbound proxy used when fetching media from DeviantArt's
+  CDN. Leave empty (`""`) unless you actually run a proxy: if this points at
+  something that isn't listening, every image 502s while pages still render,
+  because only media fetches go through it. Inside a container `127.0.0.1` is
+  the container itself, so a host-side proxy must be addressed by service name
+  or host IP, not loopback.
 * `user-agent` — String, which SkunkyArt uses as UA
+* `proxy` — Serve media through this instance instead of linking straight to
+  DeviantArt's CDN. Required by `cache`; when off, clients fetch images from
+  wixmp directly.
+* `nsfw` — Show mature content.
 
 # Setting up reverse proxy
 Pretty much business as usual, except for the [`X-Forwarded-Proto`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto) header setting.