fix(vision): report only URL origin when an image source is rejected

fetchURL echoed the whole raw URL (path, query, userinfo) in the
ErrUnsupportedSource message, so a rejected source carrying a signed
query leaked it into logs and tickets. Route the URL exit through
trace.HostOf and fall back to a placeholder instead of the raw string.

Test pins origin-only output and goes red if the fix is reverted.

internal/runtime/multimodal/vision/image.go

@@ -119,7 +119,7 @@ func decodeBase64(src string) (string, []byte, error) {
 // 网关/PROXY 返回的 HTML 错误页绝不会被当成 png 送进模型。
 func fetchURL(ctx context.Context, rawURL string, client *http.Client) (string, []byte, error) {
 	if !strings.HasPrefix(rawURL, "http://") && !strings.HasPrefix(rawURL, "https://") {
-		return "", nil, fmt.Errorf("vision: %w: %q", ErrUnsupportedSource, rawURL)
+		return "", nil, fmt.Errorf("vision: %w: %q", ErrUnsupportedSource, sourceOrigin(rawURL))
 	}
 	u, err := url.Parse(rawURL)
 	if err != nil {
@@ -242,6 +242,19 @@ func fileExists(path string) bool {
 	return err == nil && info.Mode().IsRegular()
 }
 
+// sourceOrigin 给出可进错误串的「来源」形态：只有 scheme://host（见
+// trace.HostOf），路径、查询串与 userinfo 一律不出 —— 一个被拒的来源地址同样
+// 可能带签名 query，原样回显等于把它写进日志与工单。
+//
+// 解析不出主机（`file:///…`、相对路径、畸形串）时回占位符而**绝不回落原串**：
+// 回落就是泄漏，而空串会让错误文案失去「这次拒绝的是哪一类地址」的信息。
+func sourceOrigin(rawURL string) string {
+	if origin := trace.HostOf(rawURL); origin != "" {
+		return origin
+	}
+	return "<unknown source>"
+}
+
 // defaultHTTPClient 构造 DevDocs/02-development-constraints.md §2.3
 // 所述的 HTTP client。这里每次调用返回一个新 client，
 // 而不是包级全局变量——后者为约束所禁止。