ci(windows): pre-fetch pdfium via mirror for pdfrx

pdfium_dart's native-assets hook downloads pdfium.dll from github via
package:http, which ignores HTTP_PROXY, so it fails behind the GFW.
Pre-fetch pdfium.dll through a gh-proxy mirror and pre-place it at the
hook's deterministic shared-output path (output.exists short-circuits
the download); also rewrite the hook URL to the mirror as a fallback.
Fix the build-step proxy address to the LAN proxy.

.gitea/workflows/ci.yml

@@ -114,6 +114,69 @@ jobs:
       - name: Enable Windows desktop
         run: flutter config --enable-windows-desktop
 
+      # pdfrx -> pdfium_dart pulls pdfium.dll from github.com at build time via a
+      # native-assets build hook (hook/build.dart) that uses package:http, which
+      # IGNORES HTTP_PROXY. Behind the GFW that direct download fails. The hook
+      # skips downloading when its output file already exists, so we (1) pre-fetch
+      # pdfium.dll through a CN-accessible GitHub mirror and pre-place it at the
+      # hook's deterministic shared-output path, and (2) also rewrite the hook's
+      # hardcoded GitHub URL to the mirror as a fallback.
+      - name: Pre-fetch PDFium (pdfrx native asset)
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $ProgressPreference = 'SilentlyContinue'
+          $rel = 'chromium/7811'
+          # Deterministic native-assets shared output path (verified from a real
+          # build: .dart_tool/hooks_runner/shared/pdfium_dart/build/<rel>/<plat>).
+          $dst = '.dart_tool\hooks_runner\shared\pdfium_dart\build\chromium_7811\win-x64'
+          $dll = Join-Path $dst 'pdfium.dll'
+          if (-not (Test-Path $dll)) {
+            New-Item -ItemType Directory -Force -Path $dst | Out-Null
+            $tgz = Join-Path $env:TEMP 'pdfium-win-x64.tgz'
+            $gh = "github.com/bblanchon/pdfium-binaries/releases/download/$rel/pdfium-win-x64.tgz"
+            $urls = @("https://gh-proxy.com/https://$gh", "https://ghfast.top/https://$gh", "https://$gh")
+            $curl = "$env:SystemRoot\System32\curl.exe"
+            $ok = $false
+            foreach ($u in $urls) {
+              Write-Host "Fetching PDFium: $u"
+              & $curl -L --fail --retry 2 --retry-delay 5 -o $tgz $u
+              if ($LASTEXITCODE -eq 0 -and (Test-Path $tgz)) { $ok = $true; break }
+              Write-Host "  failed (exit $LASTEXITCODE)"
+            }
+            if (-not $ok) { Write-Error "Failed to fetch PDFium from all mirrors"; exit 1 }
+            $ex = Join-Path $env:TEMP 'pdfium_extract'
+            if (Test-Path $ex) { Remove-Item -Recurse -Force $ex }
+            New-Item -ItemType Directory -Force -Path $ex | Out-Null
+            & tar -xzf $tgz -C $ex
+            if ($LASTEXITCODE -ne 0) { Write-Error "tar extract failed"; exit 1 }
+            Copy-Item (Join-Path $ex 'bin\pdfium.dll') $dll -Force
+            Remove-Item $tgz -Force
+            if (-not (Test-Path $dll)) { Write-Error "pdfium.dll not placed"; exit 1 }
+            Write-Host "PDFium pre-placed at $dll"
+          } else {
+            Write-Host "pdfium.dll already present at $dll"
+          }
+          # Fallback: rewrite the hook's hardcoded GitHub URL to the mirror, in
+          # case the pre-placed path is not consulted for some build config.
+          $roots = @($env:PUB_CACHE, "$env:LOCALAPPDATA\Pub\Cache", "$env:APPDATA\Pub\Cache") |
+            Where-Object { $_ -and (Test-Path $_) }
+          foreach ($r in $roots) {
+            $hook = Get-ChildItem -Path $r -Recurse -Filter build.dart -ErrorAction SilentlyContinue |
+              Where-Object { $_.FullName -match 'pdfium_dart-[\d.]+[\\/]hook[\\/]build\.dart' } |
+              Select-Object -First 1
+            if ($hook) {
+              $orig = 'https://github.com/bblanchon/pdfium-binaries/releases/download/'
+              $mirror = 'https://gh-proxy.com/https://github.com/bblanchon/pdfium-binaries/releases/download/'
+              $c = Get-Content -Raw -LiteralPath $hook.FullName
+              if ($c -notmatch [regex]::Escape($mirror)) {
+                Set-Content -LiteralPath $hook.FullName -Value ($c.Replace($orig, $mirror)) -NoNewline
+                Write-Host "Patched hook URL to mirror: $($hook.FullName)"
+              }
+              break
+            }
+          }
+
       # The flutter_onnxruntime plugin downloads the ONNX Runtime native lib
       # from github.com during the build, which is blocked here. Pre-place the
       # extracted SDK where the plugin expects it (via a China-accessible GitHub
@@ -149,10 +212,10 @@ jobs:
       # (CMake's file(DOWNLOAD) honours them).
       - name: Build Windows release
         env:
-          HTTP_PROXY: http://127.0.0.1:7890
-          HTTPS_PROXY: http://127.0.0.1:7890
-          http_proxy: http://127.0.0.1:7890
-          https_proxy: http://127.0.0.1:7890
+          HTTP_PROXY: http://192.168.31.189:7890
+          HTTPS_PROXY: http://192.168.31.189:7890
+          http_proxy: http://192.168.31.189:7890
+          https_proxy: http://192.168.31.189:7890
         run: flutter build windows --release
 
       - name: Show build output