Switch card data source from pokemontcg.io to TCGdex

The Pokémon TCG API is deprecated (no new keys, existing keys end 2027-03-01)
and was returning 5xx errors. TCGdex is free and needs no API key.

- src/lib/api.ts: fetch the card list, then each card and set, with retries
  and limited concurrency; map to the existing TcgCard shape. Pokémon TCG
  Pocket cards are skipped.
- Keep the old card IDs for the 10 cards whose TCGdex ID differs, so saved
  checklists stay valid (verified by name, set and number).
- Fall back to the old image host for cards TCGdex has no scan for, and to a
  placeholder if an image fails to load.
- route.ts: serve the last cached data (marked stale) when a refresh fails;
  drop the API key handling.
- Remove the API key variables from compose and the env example; update README.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

public/card-placeholder.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 300 420" role="img" aria-label="No card image available">
+  <rect x="6" y="6" width="288" height="408" rx="18" fill="#e2e8f0" stroke="#94a3b8" stroke-width="4"/>
+  <circle cx="150" cy="190" r="46" fill="none" stroke="#94a3b8" stroke-width="6"/>
+  <line x1="104" y1="190" x2="196" y2="190" stroke="#94a3b8" stroke-width="6"/>
+  <circle cx="150" cy="190" r="14" fill="#e2e8f0" stroke="#94a3b8" stroke-width="6"/>
+  <text x="150" y="300" text-anchor="middle" font-family="sans-serif" font-size="22" fill="#64748b">No image</text>
+</svg>