docs: stop claiming pixiv, and stop claiming everything gallery-dl supports (406 step 4)

Ships with the switch-off rather than with the code removal: a doc that promises a platform the product refuses is the Install and Public Surface area's characteristic defect.

pixiv comes out of README (twice), SECURITY.md (twice), .env.example and the compose header. The stored-credential warnings now name Patreon and SubscribeStar - the accounts that usually carry a payment method.

One correction beyond pixiv. README said FabledCurator follows creators on Patreon, SubscribeStar, Pixiv "and anything gallery-dl supports". That was already false: a platform not in the registry is rejected, however capable gallery-dl is. It now names the real set, which rule 171 records: Patreon, SubscribeStar, Discord and HentaiFoundry.

The 3422 docs guards still hold - the key path and bootstrap variable are untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHQB1YukL3VyvMK8rcbmV9

.env.example

@@ -93,7 +93,7 @@ DB_NAME=fabledcurator
 #
 # FabledCurator has no login, no accounts and no permission model. Anything
 # that can reach PORT is an administrator and can read the platform session
-# cookies the app stores for Patreon, SubscribeStar and Pixiv.
+# cookies the app stores for Patreon and SubscribeStar.
 #
 # Bind it to a trusted network. See "Before you expose it" in README.md and
 # the deployment posture section of SECURITY.md.

README.md

@@ -16,9 +16,9 @@ through afterwards.
   artist, tag, post and series. A newest-first feed of what just arrived as the
   front page, a random Showcase, a filterable gallery, a similarity-driven
   Explore view, and a page-turning reader for series.
-- **Subscriptions.** Follows creators on Patreon, SubscribeStar, Pixiv and
-  anything `gallery-dl` supports, on a schedule. Handles paywalled posts using
-  your own logged-in session.
+- **Subscriptions.** Follows creators on Patreon, SubscribeStar, Discord and
+  HentaiFoundry, on a schedule. Handles paywalled posts using your own
+  logged-in session.
 - **ML tagging.** Runs image models in-container to suggest tags, group
   characters, find near-duplicates and power similarity search. Suggestions are
   reviewable — it proposes, you confirm, and it learns which proposals you keep
@@ -39,8 +39,8 @@ is no config file to edit beyond a handful of bootstrap environment variables.
 permission model. Anything that can reach the port is an administrator.
 
 That matters more here than it would in most self-hosted apps, because of what
-this one stores: **live platform session cookies for Patreon, SubscribeStar and
-Pixiv** — accounts that usually have a payment method attached. Whoever reaches
+this one stores: **live platform session cookies for Patreon and
+SubscribeStar** — accounts that usually have a payment method attached. Whoever reaches
 the port can read them, alongside your entire library.
 
 So:

SECURITY.md

@@ -26,7 +26,7 @@ FabledCurator is self-hosted and holds things worth stating plainly, because
 they shape what counts as a serious bug here:
 
 - **Platform credentials.** The app captures and stores session cookies for
-  third-party subscription sites (Patreon, SubscribeStar, Pixiv) so it can
+  third-party subscription sites (Patreon, SubscribeStar) so it can
   download on the operator's behalf. These are live credentials for accounts
   that usually carry a payment method. Anything that discloses them, decrypts
   them, or lets one user of a shared instance read another's is high severity.
@@ -56,7 +56,7 @@ reverse proxy. It also does not authenticate anyone — see above. These are
 documented design decisions, not oversights.
 
 Putting this on the public internet, with or without TLS, hands whoever finds
-it your Patreon, SubscribeStar and Pixiv sessions. A reverse proxy that adds
+it your Patreon and SubscribeStar sessions. A reverse proxy that adds
 TLS but not an authentication layer does not change that.
 
 Reports that reduce to "the application is served over HTTP", "there is no

docker-compose.yml

@@ -13,7 +13,7 @@
 # explicitly skips the override and pulls the published :latest images.
 #
 # FabledCurator has no authentication. Whatever can reach ${PORT} is an
-# administrator, including over the stored Patreon/SubscribeStar/Pixiv session
+# administrator, including over the stored Patreon/SubscribeStar session
 # cookies. Do not publish this port beyond a network you trust — see
 # "Before you expose it" in README.md.