feat(immich): read Immich through a per-user read-only proxy

The browser cannot talk to Immich directly: the key must stay out of it,
COEP blocks the origin, and the app has no place to keep a key per user.
So the backend keeps it. `src/immich.ts` holds the whole surface — the
user's servers live in a JSON column on `users` (additive migration), and
every route reads the key from there and never takes a URL from the
browser except when probing one.

Albums, a page of assets, a thumbnail and an original, all behind the
normal session check. `probe` is the only route that touches a URL the
client named, and it validates it first (http/https only, no credentials,
no path, no query, no hash) so the browser cannot turn the backend into a
proxy to an arbitrary host. The key is masked down to its last four
characters everywhere it comes back out, and no log line carries it.

The share-link path is the same routes with `type: 'share'`, whose key
travels as `?key=`, so there is one code path per call rather than two.

test/immich.mjs runs a fake Immich on loopback — two keys with different
albums, one of them without `asset.download` — and checks 59 things
including that neither the responses nor the log leak a key.

docker/.env.example

@@ -23,3 +23,10 @@ SMTP_PASS=
 # What the mail says it is from. Defaults to SMTP_USER, then a noreply address.
 SMTP_FROM=
 SMTP_SECURE=
+
+# Immich, as a second photo source beside the folders on disk in LIBRARY. This is
+# only the address the "add an Immich server" dialog starts with — the key is
+# each account's own, typed in the app and kept in the database (never in the
+# browser, never in this file). Leave it empty and the field starts blank; the
+# "add Immich" button is there either way.
+IMMICH_URL=https://photos.labz.io.vn