feat: support arbitrary URL proxy via single token

Allow proxying to any URL through the single-token auth path:
- /TOKEN/https://target.com/path
- /TOKEN/https:/target.com/path (browser-normalized)
- /TOKEN/target.com/path (auto-prefixed with https:// for known domains)

Also fix single-mode path handling that previously dropped
parts[2] when SplitN produced 3 parts.

via [HAPI](https://hapi.run)

Co-Authored-By: HAPI <[email protected]>

internal/proxy/dynamic.go

@@ -0,0 +1,45 @@
+package proxy
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"time"
+)
+
+// DynamicProxy 创建指向任意目标 URL 的反向代理
+func DynamicProxy(targetURL string) http.Handler {
+	target, err := url.Parse(targetURL)
+	if err != nil {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			http.Error(w, "Invalid target URL", http.StatusBadRequest)
+		})
+	}
+
+	p := &httputil.ReverseProxy{
+		Director: func(req *http.Request) {
+			req.URL.Scheme = target.Scheme
+			req.URL.Host = target.Host
+			req.Host = target.Host
+			req.Header.Set("Host", target.Host)
+			if req.Header.Get("User-Agent") == "" {
+				req.Header.Set("User-Agent", "MirrorProxy/1.0")
+			}
+			req.Header.Del("X-Forwarded-For")
+		},
+		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
+			w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+			w.WriteHeader(http.StatusBadGateway)
+			fmt.Fprintf(w, "Proxy error: %s", err.Error())
+		},
+		Transport: &http.Transport{
+			MaxIdleConns:        100,
+			MaxIdleConnsPerHost: 20,
+			IdleConnTimeout:     90 * time.Second,
+			TLSHandshakeTimeout: 10 * time.Second,
+		},
+	}
+
+	return p
+}