security: fix 10 vulnerabilities from security audit

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/fabledassistant/rate_limit.py

@@ -1,3 +1,12 @@
+"""In-process sliding-window rate limiter.
+
+IMPORTANT — deployment note:
+  Rate limit counters are stored in memory and are lost on process restart.
+  When deployed behind a reverse proxy (nginx, Caddy, Traefik) you MUST set
+  TRUST_PROXY_HEADERS=true so that the real client IP is used as the bucket key
+  rather than the proxy's IP (which would cause all users to share one bucket).
+"""
+
 import asyncio
 import time
 from collections import defaultdict