Docs: clarify ntfy privacy — default server is public ntfy.sh

The docs claimed ntfy keeps push metadata on your own infrastructure,
but the default NTFY_SERVER_URL is the public https://ntfy.sh cloud
service. Make explicit that push metadata (topic, notification title)
passes through ntfy.sh unless you self-host ntfy.

docs/install.md

@@ -201,9 +201,12 @@ app is closed. Nothing is lost either way — on reconnect the app syncs its
 outbox.
 
 - **ntfy (default)** — the phone generates its own topic automatically; the
-  gateway publishes to it. Set `NTFY_SERVER_URL` to a **self-hosted ntfy**
-  for reliability (the public `ntfy.sh` SSE endpoint is flaky). Push metadata
-  stays on your own infrastructure — this is the private option.
+  gateway publishes to it. ⚠️ **The default server is the public
+  `https://ntfy.sh` cloud service** — push metadata (topic, notification
+  title) passes through ntfy.sh's servers. Set `NTFY_SERVER_URL` to a
+  **self-hosted ntfy** to keep push metadata on your own infrastructure —
+  that is the private option (and also more reliable: the public `ntfy.sh`
+  SSE endpoint is flaky).
 - **FCM (opt-in, `IRIS_PUSH_BACKEND=fcm`)** — standard and reliable, but push
   metadata (notification title, device token) is routed through **Google's
   servers**. Needs a Firebase project + `google-services.json` in the app