feat: add command to toggle debug mode

- Add lib/Command/DebugToggle.php to enable/disable debug endpoint via CLI
- Update lib/Controller/WebhookController.php to check debug status
- Add support for base64 attachments in lib/Service/TalkService.php
- Bump version in appinfo/info.xml to 1.1.0
- Update INSTALL.md and README.md documentation

INSTALL.md

@@ -131,6 +131,32 @@ Apprise sends a different JSON format (`title`, `body`, `type`, `attachments`)
 - The webhook endpoint is public (no auth required) but validates the auth token from the URL path
 - Admin settings endpoints (`/save-config`, `/rooms`) require admin login
 - Images are stored in the bot user's files and purged after the retention period
+- **Debug endpoint disabled by default** — see below
 - **Known limitations (to be fixed in a future release):**
   - Auth tokens generated from the settings UI use client-side generation; for higher security, regenerate them via the server API
   - The webhook endpoint has no rate limiting — consider placing it behind a reverse proxy rate limiter if exposing to untrusted sources
+
+### Debug endpoint
+
+The `/apps/ncdiscordhook/debug` endpoint exposes internal configuration,
+database schema, and bot credentials. It is **disabled by default**.
+
+```bash
+# Check status
+php occ ncdiscordhook:debug:status
+
+# Enable (WARNING: exposes sensitive data)
+php occ ncdiscordhook:debug:enable
+
+# Disable (default)
+php occ ncdiscordhook:debug:disable
+
+# Toggle current state
+php occ ncdiscordhook:debug:toggle
+```
+
+After troubleshooting, disable it immediately:
+
+```bash
+php occ ncdiscordhook:debug:disable
+```