Pre-share fixes from final review pass

Blockers
- http://birdnet.local/avian/ now serves the collage (added avian/index.html
  redirect to frontend/; previously the symlink target had no top-level
  index, so users saw a directory listing of api/ assets/ forwarding/
  frontend/ scripts/).
- Gemini model bumped from gemini-2.5-flash-image-preview (deprecated
  2026-01-15) to the stable gemini-2.5-flash-image. Pregen was non-
  functional out of the box.
- avian-mqtt.service: dropped %h (which expands to /root for system-mode
  units regardless of User=). Use WorkingDirectory=~ which DOES respect
  User=, plus a relative ExecStart.
- birdnet-api.php case 'lifelist' now aliases COUNT(*) AS n (was 'total'),
  matching what apt.js reads for atlas card counts. Atlas previously
  always displayed 0.

Bugs
- Retry-After parsing handles HTTP-date format without crashing.
- apt.js no longer fetches firstseen/timeseries (declared in state but
  never consumed). Two wasted round-trips per page load removed.
- update_birdnet.sh defaults branch=avian-visitors so the (opt-in)
  Sunday auto-update cron doesn't reset HEAD to upstream main and
  delete the avian/ overlay.
- recording.php: removed dead $BIRDS_JSON_CANDIDATES.

Polish
- Pregen --sleep default raised 4→6s (more headroom under free-tier RPM).
- en-dash in README BOM (~$35–80) replaced with hyphen for style match.
- Slop sweep across user-facing docs: no em-dashes, no en-dashes, no
  AI-slop word hits (robust/comprehensive/seamless/etc.).

avian/forwarding/README.md

@@ -1,18 +1,12 @@
-# Optional: forwarding the collage off your local network
+# Forwarding
 
-Default install hosts the collage at `http://birdnet.local/avian/` on
-your LAN with no auth. If you want it accessible from anywhere — or
-piped into Home Assistant / MQTT — pick one of the recipes below.
-
-Each recipe is independent. Skip what you don't need.
+Default install hosts the collage at `http://birdnet.local/avian/` on your LAN, no auth. The recipes below are independent. Pick what you need.
 
 ---
 
-## 1. Cloudflare Tunnel — public HTTPS, no port forwarding
+## 1. Cloudflare Tunnel
 
-Free Cloudflare account required.
-
-Install `cloudflared`:
+Public HTTPS URL, no port forwarding. Needs a free Cloudflare account.
 
 ```bash
 sudo apt install -y lsb-release
@@ -21,32 +15,22 @@ curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg \
 echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" \
   | sudo tee /etc/apt/sources.list.d/cloudflared.list
 sudo apt update && sudo apt install -y cloudflared
-```
 
-Authenticate + create the tunnel:
-
-```bash
 cloudflared tunnel login
 cloudflared tunnel create birds
 cloudflared tunnel route dns birds birds.your-domain.com
-```
 
-Configure + start the tunnel:
-
-```bash
 sudo cp ~/BirdNET-Pi/avian/forwarding/cloudflared.yml /etc/cloudflared/config.yml
-# Edit /etc/cloudflared/config.yml — set `tunnel:` to your tunnel UUID
+# Edit /etc/cloudflared/config.yml: set `tunnel:` to your UUID
 sudo cloudflared service install
 sudo systemctl restart cloudflared
 ```
 
-To password-protect the public URL, set up Cloudflare Access (free
-tier: up to 50 users). The LAN URL stays open. If you'd rather use HTTP
-Basic auth, see [`caddy-auth.caddy`](caddy-auth.caddy).
+Add a password gate via Cloudflare Access (free for up to 50 users) or via Caddy basic_auth ([`caddy-auth.caddy`](caddy-auth.caddy)).
 
 ---
 
-## 2. Home Assistant — surface latest detection as a sensor
+## 2. Home Assistant sensor
 
 Add to `configuration.yaml`:
 
@@ -65,25 +49,18 @@ rest:
           - best_conf
 ```
 
-`birdnet-api.php?action=recent` already returns `species` ordered by
-count desc; if you want most-recent first, replace the value_template
-with a sort filter.
-
 ---
 
-## 3. MQTT — fan out detections to other services
+## 3. MQTT bridge
 
 ```bash
 sudo pip3 install paho-mqtt --break-system-packages
 cp ~/BirdNET-Pi/avian/forwarding/mqtt-bridge.py ~/avian-mqtt.py
-# Edit ~/avian-mqtt.py — broker host, topic prefix, credentials
+# Edit ~/avian-mqtt.py: broker host, topic prefix, credentials
 sudo cp ~/BirdNET-Pi/avian/forwarding/avian-mqtt.service /etc/systemd/system/
-# Edit /etc/systemd/system/avian-mqtt.service — set User= to your username
+# Edit /etc/systemd/system/avian-mqtt.service: set User= to your username
 sudo systemctl daemon-reload
 sudo systemctl enable --now avian-mqtt
 ```
 
-The bridge polls `/avian/api/birdnet-api.php?action=recent&hours=1`
-once a minute and publishes new species under `birdnet/<slug>` with the
-full record as a JSON payload. Dedup is in-memory only — downstream
-consumers should be idempotent.
+Polls `birdnet-api.php?action=recent&hours=1` every 60 seconds. Publishes new species under `birdnet/<slug>` as JSON. Dedup is in-memory; restarts re-emit recent detections.