build(project): install vips-tools for image thumbnailing

Add vips-tools (vipsthumbnail) to the runtime image alongside ffmpeg and
exiftool, and document THUMB_MAX_PIXELS as the pure-Go fallback guard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -92,9 +92,10 @@ THUMB_WIDTH=160
 THUMB_HEIGHT=160
 PREVIEW_WIDTH=1920
 PREVIEW_HEIGHT=1080
-# Largest source image (in pixels, width×height) decoded to build a thumbnail or
-# preview; bigger images get a placeholder. Bounds a decompression bomb and the
-# per-image RAM cost. Default ~300 Mpx (e.g. 13000×17000).
+# Pixel cap (width×height) for the pure-Go fallback decoder, used only when
+# vipsthumbnail is NOT installed; larger images then get a placeholder. With vips
+# present (the default image) thumbnails shrink on load, so this limit — and its
+# RAM cost — don't apply. Also bounds a decompression bomb. Default ~300 Mpx.
 THUMB_MAX_PIXELS=300000000
 # How many thumbnails/previews may be generated at once. Each resize already uses
 # every core, so a burst of large images otherwise pegs the CPU and RAM. 0 = auto