AvianVisitors hardening pass — install via fork's newinstaller

Restructures the install so users run ONE command. The fork's
newinstaller.sh clones this repo (instead of upstream Nachtzuster) and
runs BirdNET-Pi's installer. install_services.sh symlinks the avian/
overlay into the Caddy site root, so http://birdnet.local/avian/ comes
up after reboot with no Caddy config needed.

Reviewer-flagged fixes:

Frontend (avian/frontend/apt.js)
- Switch all API paths from /api/*.json (which didn't route) to relative
  action-based URLs (./api/birdnet-api.php?action=recent etc.).
- Fetch ./masks.json + ./dims.json relatively (were /avian/*.json).
- Replace every innerHTML user-content sink with createElement +
  textContent + setAttribute — species labels are user-editable in
  BirdNET-Pi, so untrusted.
- Add esc() helper for the few remaining innerHTML attribute contexts.
- fetchJson throws on non-200 (was silently parsing 404 HTML as JSON).
- Defensive null-check in loadMask if MASKS hasn't loaded.

Backend (avian/api/*.php)
- birdnet-api.php now derives DB_PATH from dirname(__DIR__, 3) so any
  BirdNET-Pi install user works (no hardcoded /home/birdnet).
- recording/spectrogram/cutout use getenv('HOME') for the same reason.
- cutout.php reworked as the canonical image resolver: bundled
  illustration → bundled cutout → cached rembg → fresh
  Wikipedia+rembg, with the binomial regex guard and atomic rename
  on cache write. Wikipedia URL host pinned to wikimedia.org /
  wikipedia.org to block SSRF.
- Stale 'X-BirdNET-Proxy-Token' auth claims removed everywhere.

Pregen (avian/scripts/pregen.py)
- Gemini key moved from URL query to x-goog-api-key header.
- Model bumped to gemini-2.5-flash-image-preview.
- Bounded retry on 429 + 5xx with Retry-After honoured.
- Default --sleep raised from 1s to 4s (under free-tier RPM).
- Unified parser handles |/_/comma in all three input modes.
- responseModalities now [TEXT, IMAGE] (was IMAGE-only).
- --poses validated against POSES keys.
- ASCII [ok]/[fail] markers (was ✓/✗ — Windows console crash).
- Surfaces finishReason + blockReason on safety blocks.

Prompt template
- 'Two placeholders' typo → three.
- 'warm paper' / 'transparent background' contradiction resolved.

Forwarding
- mqtt-bridge.py: paho-mqtt 2.x CallbackAPIVersion compat shim.
- avian-mqtt.service: dropped broken %i, set User=birdnet + %h path.
- forwarding/README.md uses the actual action-based URLs.

README
- One-line install via curl … newinstaller.sh.
- No more 'install BirdNET-Pi separately' step (our fork does it).
- License section uses absolute github.com links.
- bird.onethreenine.net replaces the not-yet-existent project writeup.
- docs/thumb.png replaced with the 24-bird Twitter capture.

Removed
- avian/caddy/ and avian/scripts/install.sh — no longer needed; the
  overlay symlink in install_services.sh handles everything.

avian/api/birdnet-api.php

@@ -1,26 +1,35 @@
 <?php
-// /home/monalisa/BirdSongs/Extracted/api.php — JSON facade over BirdNET-Pi's
-// birds.db, queryable by the bird.onethreenine.net Cloudflare Worker.
-//
-// Lives in the Caddy file-server root (NOT in BirdNET-Pi/scripts/) so the
-// Sunday auto-update doesn't clobber it. Reachable as /api.php on the Pi.
-//
-// Auth: callers must send X-BirdNET-Proxy-Token matching the Caddy gate set
-// up earlier — Caddy 403s anything missing it before this script runs, so we
-// inherit that protection for free. The Cloudflare Worker is the only thing
-// that ever sets the header.
+// AvianVisitors — JSON facade over BirdNET-Pi's birds.db. Read-only.
+// Symlinked into the BirdNET-Pi Caddy site root at /avian/api/.
 //
 // Endpoints (?action=...):
-//   stats       — totals: detections, unique species, today, last hour, etc.
+//   stats       — totals (detections, unique species, today, last hour)
 //   lifelist    — every species with first_seen, last_seen, total_count
-//   recent      — &hours=N (default 24): every detection in the window
-//   species     — &sci=<sci_name>: detail page for one species
+//   recent      — &hours=N (default 24): species heard in the window
+//   species     — &sci=<sci_name>: per-species detail page
+//   timeseries  — &days=N: daily detection counts per species
+//   firstseen   — every species' earliest detection
+//
+// Default LAN deploy ships without auth. If you've exposed the Pi via
+// Cloudflare or a tunnel, add a Caddy `basic_auth` matcher around the
+// /avian/api/* path — see avian/forwarding/.
 
 declare(strict_types=1);
 header('Content-Type: application/json; charset=utf-8');
 header('Cache-Control: public, max-age=30');
 
-$DB_PATH = '/home/monalisa/BirdNET-Pi/scripts/birds.db';
+// SCRIPT_FILENAME on the Pi resolves through the symlink to
+// $HOME/BirdNET-Pi/avian/api/birdnet-api.php — walk three dirs up to
+// reach the install root, then point at scripts/birds.db. Lets a Pi
+// installed under any username (the BirdNET-Pi installer uses $USER,
+// not a fixed name) work without editing this file.
+$DB_PATH = dirname(__DIR__, 3) . '/scripts/birds.db';
+// Fallback if the symlink layout ever changes — keeps the most common
+// install path working even if SCRIPT_FILENAME oddities trip __DIR__.
+if (!file_exists($DB_PATH)) {
+    $alt = getenv('HOME') . '/BirdNET-Pi/scripts/birds.db';
+    if (file_exists($alt)) $DB_PATH = $alt;
+}
 
 if (!file_exists($DB_PATH)) {
     http_response_code(503);