[yichen11818]

Bilibili can return HTTP cover URLs, and its image CDN rejects requests with an external Referer. Normalize old search/favorite CDN URLs to HTTPS at display time and explicitly set no-referrer on cover images across search, queue, favorites, history, player and lyrics. Render the lyrics backdrop as a decorative image so it uses the same request policy.

Validation:

• Frontend typecheck, 9 tests, production and demo builds passed locally. All PR checks and Docker builds passed on GitHub.
• Called the actual backend.main.bilibili_search_videos implementation with a music query, then passed three returned artwork URLs through the actual TypeScript artworkUrl helper. All three image requests returned 200/image/jpeg without a Referer, and all three returned 403 with an external Referer.
• Separately verified a real HTTP cover URL returned by the video metadata API remains available over HTTPS.
• The existing document-wide no-referrer policy is retained. These checks confirm a CDN failure condition and URL compatibility; they do not prove that the reporter's deployed browser sent a Referer.