Add notification image proxy, expand README, fix compose env-file handling

- Proxy notification image_url server-side (GET /api/v1/notifications/:id/image)
  instead of loading it directly in the browser, so LAN-only image sources
  (e.g. Frigate snapshots) still load for clients off that network
- Tighten CSP img-src to 'self' now that images are same-origin
- Update threat model / architecture docs to match the new image-fetch design
- Expand README: Home Assistant quick-start, Pocket ID/OIDC walkthrough,
  Pangolin note, backup automation, new troubleshooting entries
- Fix docker-compose.yml: document that --env-file .env must be passed
  explicitly (Compose's implicit .env lookup was unreliable with -f from
  a different directory)
- Fix image-proxy tests to build a real session cookie (AUTH_MODE=oidc
  applies inside the test container too, so requireAuth needs one)

apps/web/src/components/notifications/NotificationRow.tsx

@@ -97,7 +97,11 @@ export function NotificationRow({
             style={{ backgroundColor: avatarColor.bg }}
           >
             {notification.imageUrl ? (
-              <img src={notification.imageUrl} alt="" className="h-full w-full object-cover" />
+              <img
+                src={`/api/v1/notifications/${notification.id}/image`}
+                alt=""
+                className="h-full w-full object-cover"
+              />
             ) : (
               <span className="text-xs font-semibold uppercase" style={{ color: avatarColor.fg }}>
                 {notification.source.slice(0, 2)}

apps/web/src/pages/NotificationDetailPage.tsx

@@ -110,7 +110,7 @@ export function NotificationDetailPage() {
 
           {notification.imageUrl && (
             <img
-              src={notification.imageUrl}
+              src={`/api/v1/notifications/${notification.id}/image`}
               alt=""
               className="max-h-96 w-full rounded-xl border border-base-border object-cover"
             />