Document that the Immich API key needs sharedLink.create

A plain read-only key (per the original setup instructions) 403s on
POST /api/shared-links -- confirmed against the live instance's
permission enum in /api/spec.json.

server/README.md

@@ -9,7 +9,10 @@ algorithm itself -- it just streams the response straight to the panel.
 ## Setup
 
 1. **Get an Immich API key**: in Immich, go to Account Settings -> API Keys
-   -> New API Key. Read-only access to albums/assets is enough.
+   -> New API Key. Needs read access to albums/assets/faces, plus
+   `sharedLink.create` (for the manage overlay's "scan to download" QR,
+   which creates a temporary public share link) -- a plain read-only key
+   will 403 on that one specific feature while everything else works.
 2. **Copy the compose file and fill in your Immich details**:
    ```
    cp docker-compose.yml.example docker-compose.yml