Isolate thumbnailer into dedicated node

[zkat]

Currently, we do all image processing in the same node and the same machine as the rest of the Banchan app.

This comes with the risk that if there's anything a vulnerability with our image processing code where malicious uploads allow arbitrary execution, they'll get full access to our internal stuff, including our db.