Add prefetch-models.sh to download AI models on host when container DNS is blocked

Lets SAM, U2Net, BEN2, and BiRefNet-HR (optionally SDXL via --sdxl) be
downloaded outside Docker into ./data/, which is already bind-mounted
into the GPU container — so a blocked container network no longer blocks
first-run setup. Reuses the existing dual-mode download_sam_model.py and
download_u2net_model.py as-is. For the HuggingFace Hub models, sets
HF_HOME (rather than --cache-dir) so the host-side cache layout matches
the container's default ~/.cache/huggingface resolution exactly, avoiding
a path-nesting mismatch between the two.

Wired into install-local-gpu.sh's completion banner and
bring-up-local-gpu.sh's header, and referenced from the relevant README
troubleshooting sections and the hf_cache bind-mount comment in
docker-compose.gpu.yml.

bring-up-local-gpu.sh

@@ -4,6 +4,10 @@
 # Run this each time you want to start the app.
 # Run ./install-local-gpu.sh once first on a new machine.
 #
+# If models fail to download inside the container (DNS/firewall blocked),
+# run ./prefetch-models.sh first — it downloads them on the host into
+# ./data/, which this container already bind-mounts, so no rebuild needed.
+#
 # Usage:
 #   ./bring-up-local-gpu.sh              # start (detached, rebuild if needed)
 #   ./bring-up-local-gpu.sh --no-build   # start without rebuilding