fix(play): bound preloadImage decode by the timeout; clarify proxy env docs

Addresses two GitHub Copilot review comments on PR #24:

- preloadImage cleared the 20s timeout in onload, before awaiting
  img.decode(), leaving the decode phase unguarded — a hung decode could
  keep the promise pending forever and stall the play loop. Move
  clearTimeout into a single idempotent done() so the timeout stays armed
  through decode() too, matching the stated "timeouts resolve quietly"
  intent.

- .env.example said to leave BOTH proxy vars blank, but shipped
  NEXT_PUBLIC_IMAGE_PROXY_ALLOWED_HOSTS=im.runware.ai. Only
  NEXT_PUBLIC_IMAGE_PROXY_URL gates the feature; the allowlist is inert
  until the URL is set. Corrected the wording, kept the self-documenting
  default value.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -57,9 +57,10 @@ TTS_SPEECH_MODEL=mimo-v2.5-tts
 MOCK_IMAGE=false
 
 # ---- 5b. Image proxy (Cloudflare Worker, OPTIONAL) -----------------
-# Leave BOTH blank (the default) and the browser fetches images directly
-# from the provider — exactly as the app worked before this proxy existed.
-# You are completely unaffected; skip this whole section.
+# Leave NEXT_PUBLIC_IMAGE_PROXY_URL blank (the default) and the browser
+# fetches images directly from the provider — exactly as the app worked
+# before this proxy existed. The ALLOWED_HOSTS value below is inert until
+# a proxy URL is set, so you're completely unaffected; skip this section.
 #
 # Why you might want it: Chrome's direct fetch of im.runware.ai is unreliable
 # on some networks (ERR_QUIC_PROTOCOL_ERROR mid-stream → partial bytes →