Auto-registered Protect cameras now get protocol='unifi' (new CHECK value)
instead of a bogus vzenith/cancela row; the camera form offers UniFi Protect
and skips credential requirements for it (webhook-only source). The alarm
image falls back to alarm.snapshot when thumbnail is absent, stripping any
data-URI prefix. Detection carries the source protocol. 3 unit tests cover
the Alarm Manager payload contract.