Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.

lib/i18n-dict.ts

@@ -742,6 +742,9 @@ const en: Record<string, string> = {
   "server.invalidOrigin": "Invalid Origin header.",
   "server.crossOrigin": "Cross-origin requests are not allowed.",
   "server.rateLimited": "Too many requests — this app allows {limit} per window. Try again in {retry}s.",
+  "server.busy": "Freezmo is already working on something — try again in a moment.",
+  "server.pushTooMany": "This server already stores {max} reminder devices — remove one first.",
+  "server.pushEndpoint": "That is not a push service this server is allowed to send to.",
   "server.authMissingKey":
     "Add your Ollama API key first — open the settings dialog (⚙️) and paste a key from ollama.com/settings/keys.",
   "server.authServerKeyMissing":
@@ -1681,6 +1684,9 @@ const cs: Record<string, string> = {
   "server.invalidOrigin": "Neplatná hlavička Origin.",
   "server.crossOrigin": "Požadavky z jiné domény nejsou povoleny.",
   "server.rateLimited": "Příliš mnoho požadavků — aplikace povoluje {limit} za okno. Zkus to znovu za {retry} s.",
+  "server.busy": "Freezmo už na něčem pracuje — zkus to za chvilku znovu.",
+  "server.pushTooMany": "Server už má uložených {max} zařízení pro připomínky — nejdřív nějaké odeber.",
+  "server.pushEndpoint": "Na tuhle službu server připomínky posílat nesmí.",
   "server.authMissingKey":
     "Nejdřív přidej svůj API klíč Ollama — otevři nastavení (⚙️) a vlož klíč z ollama.com/settings/keys.",
   "server.authServerKeyMissing":