feat(home): htmx lazy-load cover images

Replace the eager <img> on the home page with an htmx placeholder <figure>
that fetches a /cover-fragment endpoint when it scrolls into view
(hx-trigger="revealed"), so heavy cover bytes load only on demand.
Add spinner + settle-fade transition CSS, and load htmx.min.js on home.

docs/environment.md

@@ -16,6 +16,23 @@ archived at [`spec-sheet.md`](archive/spec-sheet.md)).
 | **App user** | `www-data`, group `xamxam` |
 | **Node.js** | *Not required on the server* — assets are built locally and rsync'd |
 
+## Image transcoding tooling (installed 2026-08-31)
+
+Installed on the production server to generate lightweight WebP/AVIF cover
+thumbnails (home-page cover grid — up to ~95% payload reduction):
+
+- `php-gd` — PHP GD extension (WebP/AVIF encode/resize for on-the-fly serving)
+- `webp` — provides the `cwebp` CLI (WebP conversion)
+- `libavif-bin` — provides the `avifenc` CLI (AVIF conversion)
+
+Install on any environment that must serve cover thumbnails:
+
+```bash
+sudo apt-get install php-gd webp libavif-bin
+```
+
+Consumed by the cover-thumbnail pipeline (see `docs/...` once implemented).
+
 ## PHP (≥ 8.4)
 
 Declared in `composer.json` (`"php": ">=8.4"`, platform lock `8.4`).
@@ -36,7 +53,9 @@ Verified present in the production `php -m` output and on the FPM pool:
 - `session` — admin auth + CSRF (see [`security.md`](security.md))
 - `sodium` — `Crypto` (libsodium) for encrypted fields (SMTP password)
 - `zlib` / `phar` — Composer autoload + PHAR-based tooling
-- `gd` — not used directly, present transitively (image handling is `finfo`)
+- `gd` — **intentionally installed** (`php-gd`, 2026-08-31) for cover-image
+  transcoding to WebP/AVIF; resize/encode derivations for the home-page cover
+  grid. Not used for MIME validation (that is `finfo`).
 - `fileinfo` — upload MIME validation (`finfo`)
 - `calendar`, `ctype`, `filter`, `hash`, `tokenizer`, `xml`, `libxml` — PHP core
   extensions, present by default