feat(intake): talk to the rembg sidecar, always naming u2net (#281)

Adds the client that will let the intake path remove backgrounds from submitted photos via the rembg sidecar over HTTP. isRembgConfigured() reports whether REMBG_URL is set (unconfigured is a normal, working state, not a failure), and removeBackground() posts a file to /api/remove and resolves with the PNG bytes it gets back, rejecting on every failure — unconfigured, unreachable, a non-2xx response, or a body that fails the same magic-byte PNG check the upload path already uses.

The one hard rule: every request names model=u2net explicitly and this is never configurable. The sidecar's default model, reached simply by omitting the parameter, is bria-rmbg, which is licensed non-commercial — a licensing problem that a shop cannot silently ship, and one that would produce a perfectly good image with nothing in it to reveal the mistake. The test that posts against a real stub HTTP server and asserts model=u2net appears on the wire is the only thing guarding against that regressing.

Wires REMBG_URL into both docker-compose.qa.yml and docker-compose.prod.yml as an optional variable, right after ANTHROPIC_WORKSPACE_ID, following the existing style in each file's environment block and header comment. It is deliberately left out of envValidation.ts's ALWAYS_REQUIRED — requiring it would make an environment with no sidecar refuse to boot, which is exactly the failure mode this feature is designed to avoid.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -98,6 +98,8 @@
 #   INTAKE_ACTION_SECRET  Optional. Signs the regenerate and discard links in the
 #                         intake notification email (#224). Absent, the email
 #                         still sends and carries no shortcuts.
+#   REMBG_URL             Optional. The background-removal sidecar, e.g.
+#                         http://rembg-syn:7000. Unset turns the feature off.
 #                         undrafted, which is a working configuration for the
 #                         same reason USPS is. The one credential here that
 #                         spends money per call, and on a path anybody holding
@@ -238,6 +240,10 @@ services:
       # keys need no workspace.
       - ANTHROPIC_WORKSPACE_ID=${ANTHROPIC_WORKSPACE_ID:-}
 
+      # Optional. The background-removal sidecar (#281).
+      # See docs/ops/image-background-removal-stack.md.
+      - REMBG_URL=${REMBG_URL:-}
+
       # Signs the regenerate and discard links in the intake notification email
       # (#224). Optional: absent, the notification still sends and links to the
       # review queue without shortcuts. Rotating it revokes every outstanding