security: fix 10 vulnerabilities from security audit

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api/client.ts

@@ -123,7 +123,6 @@ export interface NotificationEntry {
 export interface UserSearchResult {
   id: number
   username: string
-  email: string | null
 }
 
 // --- User search ---

frontend/src/components/ShareDialog.vue

@@ -138,7 +138,6 @@ onMounted(async () => {
               <ul v-if="userResults.length" class="user-results">
                 <li v-for="u in userResults" :key="u.id" @click="selectUser(u)" class="user-result-item">
                   <span class="user-result-name">{{ u.username }}</span>
-                  <span class="user-result-email">{{ u.email }}</span>
                 </li>
               </ul>
             </div>

frontend/src/utils/markdown.ts

@@ -38,7 +38,7 @@ const headingRenderer = {
 marked.use({ renderer: headingRenderer });
 
 const PURIFY_OPTS_FULL = {
-  ADD_ATTR: ["data-tag", "data-title", "src", "alt"],
+  ADD_ATTR: ["data-tag", "data-title"],
   FORCE_BODY: true,
 };
 

frontend/src/views/SettingsView.vue

@@ -2263,7 +2263,6 @@ FABLE_API_KEY=&lt;your-api-key&gt;</pre>
                   <ul v-if="groupMemberResults.length" class="member-results">
                     <li v-for="u in groupMemberResults" :key="u.id" class="member-result-item" @click="addMemberToGroup(g.id, u)">
                       <span class="member-result-name">{{ u.username }}</span>
-                      <span class="member-result-email">{{ u.email }}</span>
                     </li>
                   </ul>
                 </div>