fix: 使用访问域名安装 Agent 并发布下载文件

- 前端提交当前访问 origin，避免反向代理内网地址泄漏
- 校验并安全转义 Agent 服务地址
- 主程序构建时同步生成多平台 Agent 二进制

frontend/src/api/server/server.ts

@@ -39,12 +39,16 @@ export const serverApi = {
     return http.get('/dashboard/metrics');
   },
   installAgent: async (id: number | string, token: string, creds?: { username?: string; password?: string; ssh_key?: string; auth_type?: string }) => {
-    const body: Record<string, unknown> = { token };
+    // 浏览器当前 origin 是用户真实访问域名，避免反向代理把上游内网地址传给 Agent。 // Logan.Li
+    const serverUrl = typeof window !== 'undefined' ? window.location.origin : '';
+    const body: Record<string, unknown> = { token, server_url: serverUrl };
     if (creds) Object.assign(body, creds);
     return http.post<{ installed: boolean; arch: string; output: string }>(`/servers/${id}/install-agent`, body);
   },
   batchInstallAgent: async (ids: number[], token: string, credentials?: Record<number, { username?: string; password?: string; ssh_key?: string; auth_type?: string }>) => {
-    const body: Record<string, unknown> = { server_ids: ids };
+    // 批量异步任务同样显式携带公网 origin，后台 goroutine 不再依赖代理头推断。 // Logan.Li
+    const serverUrl = typeof window !== 'undefined' ? window.location.origin : '';
+    const body: Record<string, unknown> = { server_ids: ids, server_url: serverUrl };
     if (credentials) body.credentials = credentials;
     return http.post<{ total: number; success: number; results: Record<string, unknown>[] }>(`/servers/install-agent?token=${encodeURIComponent(token)}`, body);
   },