Document forward auth setup for public profiles

[Git-Romer]

Summary

• Document the full reverse-proxy allowlist needed by public trainer profiles and binders.
• Add Authentik examples for single-application and domain-level forward auth.
• Include card images, trainer sprites, compiled frontend bundles, fallback artwork, and browser assets.
• Warn against bypassing authentication for all /api routes.
• Explain that native OIDC remains a separate authentication integration.

Why

Public profile routes are anonymous inside PokéCollector, but an external forward-auth proxy sees requests first. Without explicit exceptions, /u remains inaccessible or loads without its API data and assets.

This follows up on the deployment concern raised by @engelben in #308.

Validation

• git diff --check
• node scripts/check-version.mjs
• Positive and negative checks for the documented path and full-URL regexes, including query strings
• Fresh reviewer pass with no blocking findings

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.