feat(assets): choose furniture bundle ext via FURNI_BUNDLE_EXT

Bundle the remaining imaging hardening and the host/CI fixes from the
"Doe alles" pass into one release.

Furniture:
- Resolve the local bundle extension from FURNI_BUNDLE_EXT (".hab" default,
  ".nitro" for a stock Nitro client). The configured extension is written by
  imports/repairs and preferred on lookup; the other stays a legacy fallback.

Imaging:
- Avatar proxy sends s-maxage=86400 + stale-while-revalidate (300/3600 for the
  fallback path) so the edge can hold a render a day.
- Cloudflare cache rule now covers /api/imaging/ (verified MISS->HIT live).
- Document that bare /imaging is shadowed by the edge proxy to the renderer.

Ops/CI:
- docker-update.sh skips a CI-managed host (exit 0) instead of failing cron.
- ci-deploy.sh runs the cross-browser imaging gate (chromium+firefox+webkit)
  against the candidate before cutover; DEPLOY_SKIP_CROSS_BROWSER=1 as escape.
- scripts/imager-health-alert.sh alerts (Discord) on imager up/down transitions;
  runs from cron every 5 minutes.

Tests:
- Furniture bundle-ext resolver + FURNI_BUNDLE_EXT wiring.
- Imaging performance budget (bytes + warm latency).
- classifyDdos: /api/imaging/* stays in the api bucket.

scripts/cf-setup-cache.sh

@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 # Create/update the Cloudflare Cache Rule that stores the CMS public API
-# allowlist plus the client-facing gamedata tree at the edge (the routes nginx
-# tags with `Cache-Tag: cms-public` respectievelijk `cms-gamedata`).
+# allowlist, the client-facing gamedata tree and the avatar/badge imaging
+# endpoints at the edge (the routes nginx tags with `Cache-Tag: cms-public`
+# respectievelijk `cms-gamedata`, en `/api/imaging/` dat zijn eigen s-maxage
+# stuurt).
 #
 # Why a rule is required: Cloudflare only caches a handful of file extensions
 # by default; `/api/*` responses are served `cf-cache-status: DYNAMIC` even
@@ -35,12 +37,18 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ENV_FILE="$SCRIPT_DIR/../.env"
 BASE="https://api.cloudflare.com/client/v4"
 PHASE="http_request_cache_settings"
-DESCRIPTION="EpicNabbo CMS public API + gamedata edge cache (cms-public, cms-gamedata)"
+DESCRIPTION="EpicNabbo CMS public API + gamedata + imaging edge cache (cms-public, cms-gamedata, cms-imaging)"
 
 # Cache de allowlist exact zoals nginx hem tagt (deployment/proxy/nginx-cms.conf).
 # Geen regex: `matches` vereist Business; vrije operators zijn `in` en
 # `starts_with()`.
-EXPRESSION='(http.request.method eq "GET") and (http.request.uri.path in { "/api/staff" "/api/teams" "/api/guilds" "/api/photos" "/api/leaderboard" "/api/online" "/api/online/count" "/api/shop" "/api/shop/categories" "/api/values" "/api/values/categories" "/api/radio/current-dj" "/api/radio/points/leaderboard" } or starts_with(http.request.uri.path, "/api/values/") or starts_with(http.request.uri.path, "/gamedata/"))'
+#
+# `/api/imaging/` (avatars, badges) staat erbij omdat de CMS-route zelf al
+# `s-maxage=86400` + `stale-while-revalidate` stuurt: de edge kan een avatar een
+# dag vasthouden, zodat herhaalde requests de lokale renderer nooit raken. De
+# volledige URL (inclusief figure/code) is de cache-key, dus geen vervuiling
+# tussen gebruikers.
+EXPRESSION='(http.request.method eq "GET") and (http.request.uri.path in { "/api/staff" "/api/teams" "/api/guilds" "/api/photos" "/api/leaderboard" "/api/online" "/api/online/count" "/api/shop" "/api/shop/categories" "/api/values" "/api/values/categories" "/api/radio/current-dj" "/api/radio/points/leaderboard" } or starts_with(http.request.uri.path, "/api/values/") or starts_with(http.request.uri.path, "/api/imaging/") or starts_with(http.request.uri.path, "/gamedata/"))'
 
 load_env() {
   local name="$1"