Add notification image proxy, expand README, fix compose env-file handling

- Proxy notification image_url server-side (GET /api/v1/notifications/:id/image)
  instead of loading it directly in the browser, so LAN-only image sources
  (e.g. Frigate snapshots) still load for clients off that network
- Tighten CSP img-src to 'self' now that images are same-origin
- Update threat model / architecture docs to match the new image-fetch design
- Expand README: Home Assistant quick-start, Pocket ID/OIDC walkthrough,
  Pangolin note, backup automation, new troubleshooting entries
- Fix docker-compose.yml: document that --env-file .env must be passed
  explicitly (Compose's implicit .env lookup was unreliable with -f from
  a different directory)
- Fix image-proxy tests to build a real session cookie (AUTH_MODE=oidc
  applies inside the test container too, so requireAuth needs one)

docker/docker-compose.yml

@@ -2,24 +2,27 @@
 # machine. NOT what gets deployed to Unraid — see docker-compose.prod.yml
 # and docs/phase1/06-docker-unraid-design.md for that.
 #
-# Run from the repo root:
-#   docker compose -f docker/docker-compose.yml up -d
+# Run from the repo root, ALWAYS with --env-file .env explicitly — Compose's
+# implicit .env lookup when a compose file is passed via -f from a
+# different directory is ambiguous/version-dependent, and got this wrong at
+# least once. Don't rely on it:
+#   docker compose --env-file .env -f docker/docker-compose.yml up -d
 #
-# Reads a .env file from the repo root (Compose's default project
-# directory, since that's the CWD the command above is run from) — copy
-# .env.example to .env there and fill in real values first.
+# Copy .env.example to .env in the repo root and fill in real values first.
+# Every other docker compose invocation against this file (exec, logs,
+# restart, ...) needs the same --env-file .env flag, not just `up`.
 #
 # Host ports are overridable (Unraid boxes commonly already have something
 # on 8080/5432) — e.g.:
 #   HOST_PORT_WEB=18080 HOST_PORT_INGEST=18081 HOST_PORT_PG=15432 \
-#     docker compose -f docker/docker-compose.yml up -d
+#     docker compose --env-file .env -f docker/docker-compose.yml up -d
 # or put those in the same .env file so you don't have to repeat them.
 #
 # IMPORTANT: whenever a package.json dependency changes, `--build` alone is
 # not enough — Compose reuses the OLD container's anonymous node_modules
 # volumes by default instead of repopulating them from the rebuilt image.
 # Use:
-#   docker compose -f docker/docker-compose.yml up -d --build --force-recreate -V
+#   docker compose --env-file .env -f docker/docker-compose.yml up -d --build --force-recreate -V
 # (-V / --renew-anon-volumes forces those volumes to be recreated from the
 # new image; it does not touch the named notizarr_dev_pgdata volume below.)