v0.159.0 — Issues B2: Report a problem, one AI key per request, and Remove Background in production

The second batch of the GitHub Issues program. The verdicts and test script are in the batch file.

• [x] #121 — AI requests carry only the key they use. Your own AI keys still go to our server with each AI request (never stored), but now only the one that request needs. The image-model list asks by provider name and sends no key at all; image generation, extend and background removal send only the selected provider's key; library classification sends one key, and if it fails the server falls back to its own provider rather than trying your other keys. Older clients keep working: the server still accepts the previous headers.
• [x] Report a problem, from anywhere in the app. Not only when an error appears: Report a problem is on Help → About and at the bottom of the map menu (the map's name at the top of the play screen). It asks what happened and what you expected, shows exactly what will be sent before anything leaves your browser (the page, the app version, the ids on screen, recent requests and console messages, with anything like a key removed), and works signed out as an anonymous report. Keys pasted into any report's note are now removed too.
• [x] Reports can go to a private GitHub repository (for self-hosters: REPORT_SINK=github, REPORT_GITHUB_REPO, REPORT_GITHUB_TOKEN, a fine-grained token with only Issues: write on that repository). Each report becomes an issue there, with secrets removed and the reporter's text fenced; the same system fault from many people becomes one issue with comments. If GitHub is unreachable the report goes to email or the log as before, and without the variables nothing changes.
• [x] A picture of the map, if you want one. Report a problem can include a picture of the map: tick the box, off by default, and it goes with your report, at most 1280 px wide. It shows the map as you see it, so a GM's picture includes hidden tokens faintly. It's kept 30 days, seen only by whoever reads the report queue. If it can't be uploaded, your report is still sent and says so.
• [x] #143 — Remove Background on the server works in production. The API's image was Alpine, and the library behind it only runs on glibc, so it failed with "Error loading shared library ld-linux-x86-64.so.2". The image is now Debian slim, in every build stage. For self-hosters: if you build your own image, the health checks still need wget, which the Dockerfile now installs.
• [x] #145 — Report limits are per person. Behind a load balancer the server saw only the balancer's address, so "per address" limits counted everyone together. A new setting, TRUST_PROXY_HOPS (default 0, today's behaviour), says how many proxies to believe; production's is 1. Set it to what you really have: too high lets a caller name their own address.