feat(assets): choose furniture bundle ext via FURNI_BUNDLE_EXT

Bundle the remaining imaging hardening and the host/CI fixes from the
"Doe alles" pass into one release.

Furniture:
- Resolve the local bundle extension from FURNI_BUNDLE_EXT (".hab" default,
  ".nitro" for a stock Nitro client). The configured extension is written by
  imports/repairs and preferred on lookup; the other stays a legacy fallback.

Imaging:
- Avatar proxy sends s-maxage=86400 + stale-while-revalidate (300/3600 for the
  fallback path) so the edge can hold a render a day.
- Cloudflare cache rule now covers /api/imaging/ (verified MISS->HIT live).
- Document that bare /imaging is shadowed by the edge proxy to the renderer.

Ops/CI:
- docker-update.sh skips a CI-managed host (exit 0) instead of failing cron.
- ci-deploy.sh runs the cross-browser imaging gate (chromium+firefox+webkit)
  against the candidate before cutover; DEPLOY_SKIP_CROSS_BROWSER=1 as escape.
- scripts/imager-health-alert.sh alerts (Discord) on imager up/down transitions;
  runs from cron every 5 minutes.

Tests:
- Furniture bundle-ext resolver + FURNI_BUNDLE_EXT wiring.
- Imaging performance budget (bytes + warm latency).
- classifyDdos: /api/imaging/* stays in the api bucket.

src/lib/ddos.ts

@@ -1,5 +1,13 @@
 export type DdosCategory = "pages" | "api" | "auth";
 
+/**
+ * Bucket a request path for rate limiting. Everything under `/api/` that is not
+ * an auth route counts as `api` — including `/api/imaging/*` (avatars, badges).
+ * That is intentional: imaging is a deliberate high-volume, cacheable surface,
+ * so it gets the wider api budget rather than the page budget. The bare
+ * `/imaging` renderer path never reaches this gate (it is excluded by the proxy
+ * matcher and, in production, fronted by the edge proxy directly).
+ */
 export function classifyDdos(pathname: string): DdosCategory {
 	if (
 		pathname === "/api/auth" ||