chore(deploy): NO_PROXY defaults for downloaders; explain library root modes

- compose: app gets a default NO_PROXY (UMT_NO_PROXY) listing compose
  service names incl. qbittorrent / qbittorrent-nox / qb / transmission /
  deluge / aria2, so a proxy override never swallows downloader traffic.
- runbook: proxy and test-qB override templates use the same list.
- Settings: one-line hint on library root "管理方式" (managed vs
  register_only).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker-compose.yml

@@ -188,6 +188,10 @@ services:
       BROWSER_ENABLED: ${BROWSER_ENABLED:-true}
       # 原站视图桌面模式的上游(桌面镜像的 Selkies);缺省由 BROWSER_PROVIDER_URL 推出(端口换 3000)
       BROWSER_DESKTOP_URL: ${BROWSER_DESKTOP_URL:-}
+      # 出站代理(HTTP_PROXY/HTTPS_PROXY)在 override 里给(见 docs/runbook/deploy.md「容器经宿主代理」)。
+      # Deno 按主机名匹配 NO_PROXY、不会因解析到内网 IP 而直连:同 compose 网络的服务名(postgres、camofox、
+      # 下载器 qbittorrent 等)必须列在这里,否则连下载器也会绕到代理上失败。自有下载器服务名不同就改 UMT_NO_PROXY。
+      NO_PROXY: ${UMT_NO_PROXY:-localhost,127.0.0.1,::1,postgres,camofox,proxy-relay,qbittorrent,qbittorrent-nox,qb,transmission,deluge,aria2,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}
     ports:
       - "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380"
     volumes: