feat(heal): add server-side AI inpainting endpoint via ONNX Runtime

docker/docker-compose.yml

@@ -24,9 +24,12 @@ services:
       SMTP_PASS: ${SMTP_PASS:-}
       SMTP_FROM: ${SMTP_FROM:-}
       SMTP_SECURE: ${SMTP_SECURE:-}
+      INPAINT_MODEL_PATH: /models/migan_pipeline_v2.onnx
     volumes:
       # SQLite (WAL) lives on the host so a rebuild never loses accounts.
       - ./data:/data
+      # Models directory mounted read-only for server-side AI inpainting
+      - ./frontend/public/models:/models:ro
 
   # Static SPA + /api reverse proxy. "api" is the DNS name nginx.conf proxies to,
   # so this service name is load-bearing.