fix(h5): prevent internal asset host exposure

Made-with: Proma

tests/unit/PublicUrl.spec.ts

@@ -12,6 +12,20 @@ describe('normalizeSameOriginPublicUrl', () => {
     )).toBe('/app-api/gis/sdk/minio/museum-assets/guide-final/E2/detail.jpg')
   })
 
+  it('rewrites legacy absolute media and proxy URLs without embedding their host', () => {
+    expect(normalizeSameOriginPublicUrl(
+      'http://172.20.14.21:9000/museum-assets/guide-final/E2/detail.jpg'
+    )).toBe('/app-api/gis/sdk/minio/museum-assets/guide-final/E2/detail.jpg')
+
+    expect(normalizeSameOriginPublicUrl(
+      'http://172.20.14.21:48080/yudao-server/app-api/gis/guide?stopId=1'
+    )).toBe('/yudao-server/app-api/gis/guide?stopId=1')
+
+    expect(normalizeSameOriginPublicUrl(
+      'http://172.20.14.21:19000/nhm/audio/guide.mp3'
+    )).toBe('/nhm/audio/guide.mp3')
+  })
+
   it('keeps ordinary relative paths unchanged', () => {
     expect(normalizeSameOriginPublicUrl('/static/placeholder.png'))
       .toBe('/static/placeholder.png')