Add image_url input mode (service fetches the image)

/remove-background now accepts either an uploaded `file` or an `image_url`
the service fetches itself (exactly one required). The fetch runs BEFORE
the compute gate so a slow download never holds a pool slot, and is
bounded by its own semaphore (2 x cpu_workers, hard cap 64) plus a shared
httpx client (connection reuse, matching max_connections) -- this restores
the throttling a direct upload has implicitly, so a burst of tiny URL
requests can't exhaust FDs/ephemeral ports or hammer the upstream.

Bounds: 25 MB body cap (413), 5 s connect / 15 s read timeout, <=3
redirects; MAX_IMAGE_PIXELS still applies post-decode. Deliberately NO
SSRF filtering (no private-IP/host allowlist) -- the endpoint trusts
authenticated callers; auth runs before any fetch. Do not expose to
untrusted clients without adding private-address/redirect filtering to
_fetch_image.

Adds httpx. New env knobs BGFILTER_FETCH_MAX_BYTES / BGFILTER_FETCH_TIMEOUT.
Docs (README/README_ZH/DEPLOY/DEPLOY_ZH) updated. _fetch_image unit-tested
locally (happy path, size cap ->413, bad scheme ->400, 404 ->400);
on-box end-to-end still pending (test box went offline).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -207,7 +207,8 @@ is expected to authenticate). `/healthz` is always open. See [DEPLOY.md](DEPLOY.
 
 | Field | Required | Values | Meaning |
 | --- | --- | --- | --- |
-| `file` | yes | image file | Source image (field name fixed as `file`). |
+| `file` | one of `file`/`image_url` | image file | Source image as an upload (field name fixed as `file`). |
+| `image_url` | one of `file`/`image_url` | `http(s)://…` | Source image by URL — the service fetches it (bounded by size/time; follows ≤3 redirects). Provide exactly one of `file` or `image_url`. No SSRF filtering: the endpoint trusts authenticated callers, so keep auth on and callers trusted. |
 | `background_mode` | no | `flat` (default) / `complex` | `flat` = solid-colour background (colour-keyed pipeline). `complex` = non-flat/scene background: no colour key, the segmenter alone drives the matte. `screen_color` is ignored in `complex`; expect flat backgrounds to stay stronger on hair detail. |
 | `screen_color` | no | `#RRGGBB`, or omit/empty/`auto` | Background-colour prior; omit to auto-detect from the border. Ignored when `background_mode=complex`. |
 | `seg_model` | no | `birefnet` (default) / `anime-seg` | Segmentation backend. |
@@ -228,9 +229,9 @@ is expected to authenticate). `/healthz` is always open. See [DEPLOY.md](DEPLOY.
 | Code | When |
 | --- | --- |
 | `200` | Success — body is the RGBA PNG. |
-| `400` | Bad input: unreadable image, invalid `screen_color`/`seg_model`/`cross_check`/`background_mode`, or auto-detect failed (pass `screen_color`). |
+| `400` | Bad input: unreadable image, not exactly one of `file`/`image_url`, bad `image_url` / fetch failed, invalid `screen_color`/`seg_model`/`cross_check`/`background_mode`, or auto-detect failed (pass `screen_color`). |
 | `401` | Auth enabled and the token is missing or wrong. |
-| `413` | Image exceeds `BGFILTER_MAX_IMAGE_PIXELS` (~4 MP by default). |
+| `413` | Image exceeds `BGFILTER_MAX_IMAGE_PIXELS` (~4 MP by default), or an `image_url` body exceeds `BGFILTER_FETCH_MAX_BYTES` (~25 MB). |
 | `500` | Inference failed. |
 | `503` | Service still loading models (not ready). |
 
@@ -256,6 +257,13 @@ curl -sS \
   -F "file=@scene.jpg" \
   -F "background_mode=complex" \
   http://127.0.0.1:18083/remove-background -o output.png
+
+# by URL instead of an upload (service fetches it; use image_url OR file, not both)
+curl -sS \
+  -F "image_url=https://example.com/input.png" \
+  -F "screen_color=#CFEFFF" \
+  -H "X-Genarrative-Image-Token: <token>" \
+  http://127.0.0.1:18083/remove-background -o output.png
 ```
 
 Config comes from `BGFILTER_CONFIG` (defaults to `configs/default.yaml` when present);