fix: load album art via fetch+createObjectURL to bypass mixed content block

img src http:// from file:// page is blocked; fetch() to localhost
works, so fetch the blob and use a blob: URL instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

plugin/contents/ui/dancer.html

@@ -1067,7 +1067,15 @@ function fetchTheme() {
       if (d.rgb) applyTheme(d.rgb);
       if (d.art_url && d.art_url !== lastArtUrl) {
         lastArtUrl = d.art_url;
-        document.getElementById('albumArtImg').src = 'http://127.0.0.1:8765/art?' + Date.now();
+        fetch('http://127.0.0.1:8765/art?' + Date.now())
+          .then(r => r.blob())
+          .then(blob => {
+            const img = document.getElementById('albumArtImg');
+            if (img._blobUrl) URL.revokeObjectURL(img._blobUrl);
+            img._blobUrl = URL.createObjectURL(blob);
+            img.src = img._blobUrl;
+          })
+          .catch(() => {});
       }
     })
     .catch(() => {});