Please address the comments from this code review:

## Overall Comments
- In `get_local_ip_addresses` you mention filtering out IPv6 link-local addresses (fe80::/10) but the implementation currently appends all IPv6 addresses; either implement the intended filter or adjust the comment to avoid confusion and ensure only routable addresses are returned.
- The CORS setup in `AstrBotDashboard._init_app` currently hard-codes `allow_origin="*", allow_methods="*", allow_headers="*"`; consider making these values configurable (e.g., from dashboard config) or at least restricting them for non-development deployments to avoid unnecessarily broad cross-origin exposure.

## Individual Comments

### Comment 1
<location> `dashboard/src/main.ts:93` </location>
<code_context>
-// Keep fetch() calls consistent with axios by automatically attaching the JWT.
-// Some parts of the UI use fetch directly; without this, those requests will 401.
-const _origFetch = window.fetch.bind(window);
-window.fetch = (input: RequestInfo | URL, init?: RequestInit) => {
-  const token = localStorage.getItem('token');
-  if (!token) return _origFetch(input, init);
</code_context>

<issue_to_address>
**suggestion (bug_risk):** The custom fetch wrapper may behave unexpectedly when `input` is a `Request` object, especially combined with URL rewriting.

Because you merge `headers` from `input.headers` but still pass the original `init` into `_origFetch(url, { ...init, headers })`, a `Request` input can lose or mismatch properties (method, body, credentials, etc.) relative to the original request.

Consider normalizing to a `Request` first, then rewriting only the URL and headers, for example:

```ts
window.fetch = (input, init) => {
  const currentBaseUrl = axios.defaults.baseURL;
  let url = typeof input === "string" || input instanceof URL ? input.toString() : input.url;

  if (typeof url === "string" && url.startsWith("/api") && currentBaseUrl) {
    const cleanBase = currentBaseUrl.replace(/\/+$/, "");
    const cleanPath = url.replace(/^\/+/, "");
    url = `${cleanBase}/${cleanPath}`;
  }

  const token = localStorage.getItem("token");
  const orig = input instanceof Request ? input : new Request(url, init);
  const headers = new Headers(orig.headers);
  if (token && !headers.has("Authorization")) {
    headers.set("Authorization", `Bearer ${token}`);
  }

  const request = new Request(url, { ...orig, headers });
  return _origFetch(request);
};
```

Suggested implementation:

```typescript
  // 优先使用 localStorage 中的配置，其次是 config.json，最后是空字符串
  const localApiUrl = localStorage.getItem("apiBaseUrl");
  const apiBaseUrl = localApiUrl !== null ? localApiUrl : configApiUrl;

  // Keep fetch() calls consistent with axios by automatically attaching the JWT
  // and normalizing Request handling so method/body/etc. are preserved.
  const _origFetch = window.fetch.bind(window);
  window.fetch = (input: RequestInfo | URL, init?: RequestInit) => {
    const currentBaseUrl = axios.defaults.baseURL;
    let url =
      typeof input === "string" || input instanceof URL
        ? input.toString()
        : input.url;

    if (typeof url === "string" && url.startsWith("/api") && currentBaseUrl) {
      const cleanBase = currentBaseUrl.replace(/\/+$/, "");
      const cleanPath = url.replace(/^\/+/, "");
      url = `${cleanBase}/${cleanPath}`;
    }

    const token = localStorage.getItem("token");
    const orig =
      input instanceof Request ? input : new Request(url, init);
    const headers = new Headers(orig.headers);

    if (token && !headers.has("Authorization")) {
      headers.set("Authorization", `Bearer ${token}`);
    }

    const request = new Request(url, { ...(orig as RequestInit), headers });
    return _origFetch(request);
  };

  if (apiBaseUrl) {
    console.log(

```

If `axios` is not already imported in `dashboard/src/main.ts`, you should add an appropriate import at the top of the file (for example, `import axios from "axios";`) so that `axios.defaults.baseURL` is available. Also confirm the file is compiled with DOM lib types so that `Request`, `RequestInfo`, and `RequestInit` are recognized.
</issue_to_address>

### Comment 2
<location> `README.md:271` </location>
<code_context>
-陪伴与能力从来不应该是对立面。我们希望创造的是一个既能理解情绪、给予陪伴，也能可靠完成工作的机器人。
+_私は、高性能ですから!_

+<img src="https://files.astrbot.app/watashiwa-koseino-desukara.gif" width="100"/>

</code_context>

<issue_to_address>
**suggestion:** Consider adding an `alt` attribute to the image for better accessibility.

For example: `<img src="..." width="100" alt="Short description of the robot GIF" />` so screen readers can convey the content of the animation.
</issue_to_address>

### Comment 3
<location> `dashboard/src/main.ts:15` </location>
<code_context>
-import { loader } from '@guolao/vue-monaco-editor'
-import axios from 'axios';
-
-// 初始化新的i18n系统，等待完成后再挂载应用
-setupI18n().then(() => {
-  console.log('🌍 新i18n系统初始化完成');
</code_context>

<issue_to_address>
**issue (complexity):** Consider extracting shared app bootstrap and HTTP setup logic into small helpers to reduce duplication and keep `initApp` focused on orchestration.

You can cut a good chunk of complexity/duplication without changing behavior by extracting two small helpers:

### 1. Deduplicate app bootstrap in `setupI18n` branches

Both `then` and `catch` branches do the same app creation + plugin registration + presets wiring. You can centralize that and keep `setupI18n` control flow simple:

```ts
async function createAndMountApp(presets: any[]) {
  const app = createApp(App);
  app.use(router);

  const pinia = createPinia();
  app.use(pinia);

  const { useApiStore } = await import("@/stores/api");
  const apiStore = useApiStore(pinia);
  apiStore.setPresets(presets);

  app.use(print);
  app.use(VueApexCharts);
  app.use(vuetify);
  app.use(confirmPlugin);

  // Inline mountApp logic here to avoid another layer of indirection,
  // or call your existing mountApp(app, pinia)
  app.mount("#app");

  import("./stores/customizer").then(({ useCustomizerStore }) => {
    const customizer = useCustomizerStore(pinia);
    vuetify.theme.global.name.value = customizer.uiTheme;
    const storedPrimary = localStorage.getItem("themePrimary");
    const storedSecondary = localStorage.getItem("themeSecondary");
    if (storedPrimary || storedSecondary) {
      const themes = vuetify.theme.themes.value;
      ["PurpleTheme", "PurpleThemeDark"].forEach((name) => {
        const theme = themes[name];
        if (!theme?.colors) return;
        if (storedPrimary) theme.colors.primary = storedPrimary;
        if (storedSecondary) theme.colors.secondary = storedSecondary;
        if (storedPrimary && theme.colors.darkprimary)
          theme.colors.darkprimary = storedPrimary;
        if (storedSecondary && theme.colors.darksecondary)
          theme.colors.darksecondary = storedSecondary;
      });
    }
  });
}
```

Then `initApp`’s i18n part becomes:

```ts
// 初始化新的i18n系统，等待完成后再挂载应用
setupI18n()
  .then(async () => {
    console.log("🌍 新i18n系统初始化完成");
    await createAndMountApp(presets);
  })
  .catch(async (error) => {
    console.error("❌ 新i18n系统初始化失败:", error);
    // 即使i18n初始化失败，也要挂载应用（使用回退机制）
    await createAndMountApp(presets);
  });
```

This removes the duplicated app setup and avoids drift between branches.

### 2. Isolate HTTP setup (axios + fetch) from `initApp`

The axios + `window.fetch` override logic is dense and not directly about bootstrapping. Moving it into a focused helper keeps `initApp` readable:

```ts
function setupHttp(apiBaseUrl: string) {
  axios.defaults.baseURL = apiBaseUrl;

  axios.interceptors.request.use((config) => {
    const token = localStorage.getItem("token");
    if (token) {
      config.headers["Authorization"] = `Bearer ${token}`;
    }
    return config;
  });

  const _origFetch = window.fetch.bind(window);
  window.fetch = (input: RequestInfo | URL, init?: RequestInit) => {
    let url = input;
    const currentBaseUrl = axios.defaults.baseURL;

    if (
      typeof input === "string" &&
      input.startsWith("/api") &&
      currentBaseUrl
    ) {
      const cleanBase = currentBaseUrl.replace(/\/+$/, "");
      const cleanPath = input.replace(/^\/+/, "");
      url = `${cleanBase}/${cleanPath}`;
    }

    const token = localStorage.getItem("token");
    if (!token) return _origFetch(url, init);

    const headers = new Headers(
      init?.headers ||
        (typeof input !== "string" && "headers" in input
          ? (input as Request).headers
          : undefined),
    );
    if (!headers.has("Authorization")) {
      headers.set("Authorization", `Bearer ${token}`);
    }
    return _origFetch(url, { ...init, headers });
  };
}
```

Then in `initApp`:

```ts
const apiBaseUrl = localApiUrl !== null ? localApiUrl : configApiUrl;

if (apiBaseUrl) {
  console.log(
    `API Base URL set to: ${apiBaseUrl} (Local: ${localApiUrl}, Config: ${configApiUrl})`,
  );
}

setupHttp(apiBaseUrl);

// loader.config(...)
// setupI18n().then(...).catch(...)
```

This keeps all current behavior (config-driven `apiBaseUrl`, presets, consistent JWT handling for axios/fetch) but reduces repetition, flattens control flow, and lets `main.ts` read more as “orchestration” than “HTTP client + app factory”.
</issue_to_address>

### Comment 4
<location> `dashboard/src/components/chat/LiveMode.vue:343` </location>
<code_context>
        wsBase = apiBase.replace("http://", "ws://");
</code_context>

<issue_to_address>
**security (javascript.lang.security.detect-insecure-websocket):** Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.

*Source: opengrep*
</issue_to_address>

### Comment 5
<location> `dashboard/src/components/chat/LiveMode.vue:345` </location>
<code_context>
        wsBase = "ws://" + apiBase;
</code_context>

<issue_to_address>
**security (javascript.lang.security.detect-insecure-websocket):** Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.

*Source: opengrep*
</issue_to_address>