Add MA_URL to download covers through a reverse proxy

The jail can't reach Music Assistant's port 8095. MA_URL replaces the host of Music Assistant's image URLs when downloading. fetch-covers now stops at the first connection failure instead of stalling on every album, and image connections time out after 3 seconds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -38,6 +38,7 @@ Environment variables:
 | `HA_URL` | Home Assistant base URL, e.g. `https://ha.home.knbg` |
 | `HA_TOKEN` | HA long-lived access token, used to search the Music Assistant library |
 | `DB_PATH` | SQLite file (default `tag_albums.sqlite3`); its directory must be writable |
+| `MA_URL` | Optional. Address to download Music Assistant cover images from, e.g. `https://ma.home.knbg`, when Music Assistant's own address (`http://<host>:8095`) isn't reachable from the service. See [Album covers](#album-covers). |
 
 HTTPS to HA is verified against the system trust store, so a home CA must be installed on the host. If it isn't, point `SSL_CERT_FILE` at the CA bundle.
 
@@ -112,6 +113,20 @@ su -m tagalbums -c 'set -a; . /usr/local/etc/tag_albums.env; set +a; .venv/bin/t
 
 It lists the albums Music Assistant has no cover for; those keep the grey placeholder. Running it again only looks at assignments still missing a cover.
 
+The service downloads covers from the address Music Assistant reports: its own host and port 8095, over plain http. If the jail can't reach that, put Music Assistant's image proxy behind the reverse proxy and set `MA_URL` to it. For example, in Caddy (use the same TLS setup as your other sites):
+
+```caddyfile
+ma.home.knbg {
+	@images path /imageproxy/*
+	handle @images {
+		reverse_proxy 172.16.40.250:8095
+	}
+	respond 404
+}
+```
+
+Then add `MA_URL=https://ma.home.knbg` to the env file and restart the service. Only `/imageproxy/*` is exposed, not the Music Assistant interface. If `fetch-covers` can't connect, it stops at the first cover and says so.
+
 ### Updating
 
 ```sh