Fix FilesBlock: external URLs bypass /cms-files proxy

getCmsFileUrl() returned /cms-files?src=... for all URLs including
external ones. resolveCmsSource() rejects foreign hosts (SSRF guard),
so external file links 404'd. External http(s) URLs now returned directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/rusty-file.ts

@@ -62,8 +62,13 @@ export interface CmsFileUrlOptions {
 /**
  * Lokale Datei-URL: /cms-files?src=…&name=…&dl=…
  * `src` = volle Datei-URL oder CMS-Asset-Pfad (`/api/assets/...`).
+ * Externe http(s)-URLs werden direkt zurückgegeben — der /cms-files-Proxy
+ * würde sie wegen SSRF-Schutz sowieso ablehnen.
  */
 export function getCmsFileUrl(src: string, opts: CmsFileUrlOptions = {}): string {
+  if (src.startsWith('http://') || src.startsWith('https://')) {
+    return src;
+  }
   const params = new URLSearchParams();
   params.set('src', src);
   if (opts.filename) params.set('name', opts.filename);