Switch card data source from pokemontcg.io to TCGdex

The Pokémon TCG API is deprecated (no new keys, existing keys end 2027-03-01)
and was returning 5xx errors. TCGdex is free and needs no API key.

- src/lib/api.ts: fetch the card list, then each card and set, with retries
  and limited concurrency; map to the existing TcgCard shape. Pokémon TCG
  Pocket cards are skipped.
- Keep the old card IDs for the 10 cards whose TCGdex ID differs, so saved
  checklists stay valid (verified by name, set and number).
- Fall back to the old image host for cards TCGdex has no scan for, and to a
  placeholder if an image fails to load.
- route.ts: serve the last cached data (marked stale) when a refresh fails;
  drop the API key handling.
- Remove the API key variables from compose and the env example; update README.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.local.example

@@ -1,11 +1,4 @@
-# Get a free API key at https://dev.pokemontcg.io/
-# Then copy this file to .env.local and paste your key(s) below
-
-# Client-side API key (exposed to browser)
-NEXT_PUBLIC_POKEMON_TCG_API_KEY=
-
-# Optional: Server-side API key (preferred). If set, server uses this and does not rely on public key.
-POKEMON_TCG_API_KEY=
+# No API key is needed: card data comes from the free TCGdex API (https://tcgdex.dev/).
 
 # Optional: Enable very simple single-user Basic Auth (set both to enable)
 BASIC_AUTH_USER=