feat: custom terminal background image + theme editor hardening

- settings: backgroundImage/backgroundImageOpacity (10..100, default 60)
- main: otimg:// protocol serves only the configured background file
  (path-allowlisted, 403 otherwise); dev http origin cannot load file:
- TerminalView: allowTransparency + transparent theme background while an
  image is set; .term-bg-image layer behind the xterm surface
- terminal.css: .has-bg-image keeps .xterm-viewport transparent — the old
  chrome-bg pin covered the image layer (root cause of image not showing)
- ThemeSettingsTab: image picker + opacity slider
- ThemeEditor: duplicate-name hint now covers builtin names too; seed
  colors normalized to #rrggbb
- settingsStore: sanitize theme colors, reject non-hex values

src/main/index.ts

@@ -1,6 +1,7 @@
-import { app, BrowserWindow, globalShortcut, nativeImage, shell } from 'electron'
+import { app, BrowserWindow, globalShortcut, net, nativeImage, protocol, shell } from 'electron'
 import { existsSync } from 'fs'
 import { join } from 'path'
+import { pathToFileURL } from 'url'
 import { isTrustedRendererUrl, registerIpc } from './ipc'
 import { killAllPtys, killPtysByOwner } from './pty'
 import { applyStartupSystemSettings, loadSettings } from './settingsStore'
@@ -45,6 +46,14 @@ if (!app.isPackaged) {
   app.setPath('userData', join(app.getPath('appData'), 'OpenTerminal-dev'))
 }
 
+// Custom background image (设置 → 主题): the renderer page cannot load file:
+// subresources directly (Chromium blocks them from non-file origins), so it
+// references them through this scheme instead. The handler serves exactly one
+// file — the configured background image — nothing else.
+protocol.registerSchemesAsPrivileged([
+  { scheme: 'otimg', privileges: { secure: true, supportFetchAPI: false, corsEnabled: false } }
+])
+
 // Single instance: a second launch just surfaces the existing window (pulls
 // it out of the tray if hidden there) instead of starting another process.
 // The refused instance skips the whole startup path: `app.quit()` only asks
@@ -57,6 +66,19 @@ if (!gotSingleInstanceLock) {
   app.on('second-instance', () => showOrCreate())
 
   app.whenReady().then(() => {
+    // Serve the configured background image (path lives in settings; anything
+    // else — including a path that is no longer configured — is refused, so the
+    // protocol cannot be used to read arbitrary files).
+    protocol.handle('otimg', (request) => {
+      const url = new URL(request.url)
+      const requested = decodeURIComponent(url.pathname.replace(/^\//, ''))
+      const allowed = loadSettings().terminal.backgroundImage
+      if (allowed === '' || requested !== allowed || !existsSync(requested)) {
+        return new Response('', { status: 403 })
+      }
+      return net.fetch(pathToFileURL(requested).toString())
+    })
+
     registerIpc()
     registerUpdateIpc()
     // Before the window exists: a renderer-triggered check must not run against

src/main/settingsStore.ts

@@ -138,11 +138,15 @@ function sanitizeThemes(value: unknown, warnings: Warnings): TerminalTheme[] {
         : null
     const colors: ThemeColors = { ...DEFAULT_DARK.colors }
     const target = colors as unknown as Record<string, string>
+    const HEX_COLOR = /^#(?:[0-9a-f]{3}|[0-9a-f]{6}|[0-9a-f]{8})$/i
     for (const key of THEME_COLOR_KEYS) {
       const color = candidate?.[key]
-      if (typeof color === 'string' && color !== '') target[key] = color
-      else if (color !== undefined) {
-        warnings.push(`customThemes[${index}].colors.${key} repaired → built-in default`)
+      // Only well-formed hex colours survive: xterm would render anything else
+      // as black, and the theme editor's native colour input needs #rrggbb.
+      if (typeof color === 'string' && HEX_COLOR.test(color.trim())) {
+        target[key] = color.trim()
+      } else if (color !== undefined) {
+        warnings.push(`customThemes[${index}].colors.${key}: not a hex color — repaired`)
       }
     }
     themes.push({