Add MA_URL to download covers through a reverse proxy

The jail can't reach Music Assistant's port 8095. MA_URL replaces the host of Music Assistant's image URLs when downloading. fetch-covers now stops at the first connection failure instead of stalling on every album, and image connections time out after 3 seconds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_app.py

@@ -176,3 +176,28 @@ def test_import_yaml(tmp_path):
     store = Store(db)
     assert store.get("29-92-68-C5").album == "Van Woede Tot Wanhoop"
     store.close()
+
+
+def test_fetch_covers_stops_when_music_assistant_is_unreachable(store, library):
+    import httpx
+    import pytest
+
+    def unreachable(url):
+        raise httpx.ConnectTimeout("timed out")
+
+    library.fetch_image = unreachable
+    library.image_download_url = lambda url: url
+    store.assign("A", "Tool", "Lateralus")
+    store.assign("B", "Kiasmos", "Kiasmos")
+    with pytest.raises(SystemExit, match="Set MA_URL"):
+        fetch_covers(store, library)
+
+
+def test_settings_read_ma_url(monkeypatch):
+    from tag_albums.config import Settings
+
+    for k, v in {"API_TOKEN": "t", "HA_URL": "https://ha/", "HA_TOKEN": "h", "MA_URL": "https://ma.example/"}.items():
+        monkeypatch.setenv(k, v)
+    assert Settings.from_env().ma_url == "https://ma.example"
+    monkeypatch.delenv("MA_URL")
+    assert Settings.from_env().ma_url is None