Configurable TMDB API base URL / proxy support (ISPs performing SNI-based blocking of api.themoviedb.org)

[trinknx]

Description

I'm always frustrated when Seerr becomes completely unusable on networks
where the ISP performs SNI-based DPI blocking of api.themoviedb.org
(this is common in Vietnam, but it affects any network with this kind of
filtering).

Because the TMDB base URL is hardcoded with no override, every page that
needs metadata (discover, title details, search) returns 404 "Something
Went Wrong" or 500, and the log fills up with:

[error][Plex Scan]: Failed to process Plex media {"errorMessage":
  "[TMDB] Failed to find media using external IMDb ID:
   [TMDB] Failed to find by external ID: read ECONNRESET", ...}

This is not an IP-level block, so DNS-based workarounds (ControlD/NextDNS
proxy rules, alternate A records) cannot help — the ISP matches the
plaintext SNI field in the TLS ClientHello:

# any destination IP + SNI api.themoviedb.org:
$ openssl s_client -connect 206.253.89.97:443 -servername api.themoviedb.org
write:errno=104                      # reset mid-handshake, no certificate

# same IP + port, different SNI:
$ openssl s_client -connect 206.253.89.97:443 -servername image.tmdb.org
subject=CN = image.tmdb.org
Verification: OK                     # handshake completes fine

Note image.tmdb.org is NOT filtered — only the API host is.

Current workaround: run a small Cloudflare Worker reverse-proxying
api.themoviedb.org and patch the one occurrence of the base URL inside
the container:

sed -i 's|https://api.themoviedb.org/3|https://tmdb.<account>.workers.dev/3|' \
  /app/dist/api/themoviedb/index.js

It works flawlessly, but the patch is wiped on every image update.

### Desired Behavior

Provide an official, default-preserving way to point the TMDB client at an
alternate endpoint, e.g. an environment variable:

TMDB_API_BASE_URL=https://tmdb.example.workers.dev/3

(or an equivalent setting in Settings → Services).

Only the hostname needs to be overridable — API key handling, request
paths, and response parsing work unchanged against a transparent reverse
proxy, so existing installs that don't set the variable would be completely
unaffected.

This would make Seerr usable out-of-the-box on SNI-filtered networks
without manually patching the image after every update.

### Additional Context

_No response_

### Search Existing Issues

- [x] Yes, I have searched existing issues.

### Code of Conduct

- [x] I agree to follow Seerr's Code of Conduct