Add notification image proxy, expand README, fix compose env-file handling

- Proxy notification image_url server-side (GET /api/v1/notifications/:id/image)
  instead of loading it directly in the browser, so LAN-only image sources
  (e.g. Frigate snapshots) still load for clients off that network
- Tighten CSP img-src to 'self' now that images are same-origin
- Update threat model / architecture docs to match the new image-fetch design
- Expand README: Home Assistant quick-start, Pocket ID/OIDC walkthrough,
  Pangolin note, backup automation, new troubleshooting entries
- Fix docker-compose.yml: document that --env-file .env must be passed
  explicitly (Compose's implicit .env lookup was unreliable with -f from
  a different directory)
- Fix image-proxy tests to build a real session cookie (AUTH_MODE=oidc
  applies inside the test container too, so requireAuth needs one)

docs/migration-ntfy.md

@@ -85,11 +85,15 @@ full protocol clone (and some of these are explicit non-goals — see
   into emoji prefixes. If you want an emoji in the title, put it directly in
   the `Title:` header or JSON `title` field, same as ntfy's own
   emoji-in-title convention.
-- **Attachments.** `Attach:` is treated as an image URL the browser loads
-  directly — there's no server-side download, proxying, or file upload.
-  This is a deliberate security choice (see the SSRF section of
-  [docs/phase1/02-threat-model.md](phase1/02-threat-model.md)), not a
-  temporary gap.
+- **Attachments.** `Attach:` is treated as an image URL. The server fetches
+  and proxies it (`GET /api/v1/notifications/:id/image`) rather than
+  handing the raw URL to the browser — deliberately so a LAN-only image
+  source (a camera snapshot, say) still loads for a client that's off that
+  LAN, since the server sits on it persistently. Still no arbitrary file
+  upload, and the fetch is narrowly scoped (see the SSRF section of
+  [docs/phase1/02-threat-model.md](phase1/02-threat-model.md)) — only the
+  fixed URL already stored on a notification the caller can see, never a
+  client-supplied one.
 - **Auth is required by default.** Unlike a bare ntfy instance, publishing
   always needs a valid `Authorization: Bearer` token — there's no
   anonymous-publish mode.