fix: block non-http(s) schemes, sanitize API_KEY backslash, improve viewport error message

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker/start.sh

@@ -20,6 +20,7 @@ _buildConfig() {
         *)          block_private=false ;;
     esac
     api_key="${API_KEY:-}"
+    api_key="${api_key//\\/}"
     api_key="${api_key//\'/}"
     echo "<?php"
     echo "date_default_timezone_set('Europe/Vienna');"