- Proxy notification image_url server-side (GET /api/v1/notifications/:id/image)
instead of loading it directly in the browser, so LAN-only image sources
(e.g. Frigate snapshots) still load for clients off that network
- Tighten CSP img-src to 'self' now that images are same-origin
- Update threat model / architecture docs to match the new image-fetch design
- Expand README: Home Assistant quick-start, Pocket ID/OIDC walkthrough,
Pangolin note, backup automation, new troubleshooting entries
- Fix docker-compose.yml: document that --env-file .env must be passed
explicitly (Compose's implicit .env lookup was unreliable with -f from
a different directory)
- Fix image-proxy tests to build a real session cookie (AUTH_MODE=oidc
applies inside the test container too, so requireAuth needs one)
siliconsolder
079013730b