security: fix 10 vulnerabilities from security audit

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/fabledassistant/routes/chat.py

@@ -5,7 +5,7 @@ import logging
 import httpx
 from quart import Blueprint, Response, jsonify, request
 
-from fabledassistant.auth import login_required, get_current_user_id
+from fabledassistant.auth import admin_required, login_required, get_current_user_id
 from fabledassistant.routes.utils import not_found, parse_pagination
 from fabledassistant.config import Config
 from fabledassistant.services.chat import (
@@ -439,7 +439,7 @@ async def list_models_route():
 
 
 @chat_bp.route("/models/pull", methods=["POST"])
-@login_required
+@admin_required
 async def pull_model_route():
     """Pull a model from Ollama, streaming progress via SSE."""
     data = await request.get_json()
@@ -478,7 +478,7 @@ async def pull_model_route():
 
 
 @chat_bp.route("/models/delete", methods=["POST"])
-@login_required
+@admin_required
 async def delete_model_route():
     """Delete a model from Ollama."""
     data = await request.get_json()