Fix weather satellite decoder security, architecture, and race conditions

Security: replace path traversal-vulnerable str().startswith() with
is_relative_to(), anchor path checks to app root, strip filesystem
paths from error responses, add decoder-level path validation.

Architecture: use safe_terminate/register_process for subprocess
lifecycle, replace custom SSE generator with sse_stream(), use
centralized validate_* functions, remove unused app.py declarations.

Bugs: add thread-safe singleton locks, protect _images list across
threads, move blocking process.wait() to async daemon thread, fix
timezone handling for tz-aware datetimes, use full path for image
deduplication, guard TLE auto-refresh during tests, validate
scheduler parameters to avoid 500 errors.

Docker: pin SatDump to v1.2.2 and slowrx to ca6d7012, document
INTERCEPT_IMAGE fallback pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -12,6 +12,8 @@
 
 services:
   intercept:
+    # When INTERCEPT_IMAGE is set, use that pre-built image; when empty/unset,
+    # the empty string causes Docker Compose to fall through to the build: directive.
     image: ${INTERCEPT_IMAGE:-}
     build: .
     container_name: intercept
@@ -61,6 +63,7 @@ services:
   # ADS-B history with Postgres persistence
   # Enable with: docker compose --profile history up -d
   intercept-history:
+    # Same image/build fallback pattern as above
     image: ${INTERCEPT_IMAGE:-}
     build: .
     container_name: intercept-history