MangaBox: send Referer on image requests

[maxpower212]

Summary

Mangabox image CDNs now reject hotlinked requests, so every chapter page fails to load for the sources built on this theme (Mangabat, Mangakakalot, Manganelo). imageRequest() is built from the default headers, which carry no Referer at all, so each request gets a Cloudflare 403 and the CDN fallback interceptor ends in IOException("All CDN attempts failed"), which is what users see as the CDN error.

This sends the Referer the CDNs now require, and reuses the same headers for the merge-images size probe, which issued the same headerless request and therefore silently disabled merging.

Evidence

Measured against Mangabat's CDN from a residential connection, using the request shape the extension produces (no cookies, no special session):

Request to imgs-2.2xstorage.com/apotheosis/1/0.webp	Result
no Referer	403, 4548 bytes, Cloudflare "Attention Required" page
Referer: https://example.com/	403
Referer: https://www.mangabats.com/manga/apotheosis/chapter-1 (the chapter URL)	403
Referer: https://mangabats.com/ (no www)	403
Referer: https://www.mangabats.com (no trailing slash)	403
Referer: https://www.mangabats.com/	200, image/webp, 84 KB

• Reproduced on pages 0, 5 and 12 of the same chapter, and repeated runs of the same URL return the same result, so it is not a cache artefact.
• User agent is not the variable: 403 with the app user agent, okhttp/4.12.0 and a Mihon-style agent, and 200 with every one of them once the Referer is correct.
• The two fallback hosts the theme learns (img-r1/img-r2.2xstorage.com) return 404 for these same paths even with the correct Referer, so the existing failover cannot rescue it.
• End to end: all 22 pages of a real chapter fetch at 200 with the header (2.3 MB total), and all 22 fail without it.

Changes

• imageRequest() now sends Referer: $baseUrl/. baseUrl follows the configured mirror, so the Mangakakalot and Manganelo mirrors send their own origin.
• The merge-images size probe uses the same headers, so its size requests stop 403ing.
• baseVersionCode 15 -> 16, since this is multisrc theme code.

Not verified

Mangabat (www.mangabats.com) is the only one I could verify. mangakakalot.gg and natomanga.com chapter pages are currently behind a Cloudflare challenge from this network, so I could not confirm the requirement there. The added header is additive for them, and the origin sent is whatever mirror the user has configured.

Checklist

• Updated versionCode value in build.gradle.kts — not applicable, the change is in multisrc theme code rather than a single extension
• Updated baseVersionCode in build.gradle.kts — 15 -> 16
• Referenced all related issues in the PR body — no issue was filed; this came out of debugging a broken source on a user's device
• Set the contentWarning configuration in build.gradle.kts appropriately — untouched
• Have not changed source names
• Have explicitly kept the id if a source's name or language were changed — not applicable
• Have tested the modifications by compiling and running the extension through Android Studio — the request behaviour is verified at the HTTP layer; the compile and lint run is left to CI
• Have removed web_hi_res_512.png when adding a new extension — not applicable
• This PR is AI-assisted, I have reviewed the changes manually and confirmed they are not slop — left for the account holder to confirm

🤖 This PR was opened by an AI agent (Hermes Agent, running on the account holder's own machine) at the request of a user whose reading was broken by this. The diff, the measurements above and the version bump were produced and verified by that agent; the account holder authorised submitting it and has been given the evidence. The AI-assisted box above is theirs to tick.