feat(server): podpuddle scaffold + Fastify backend (nostr auth, RSS, streams)

- docker-compose stack: podpuddle + MediaMTX (RTMP/WHIP/HLS) + blossom-server
- NIP-98 nostr-only login with session cookies, replay guard, clock-skew window
- podcasts/episodes CRUD; episodes register browser-uploaded blossom blobs
- RSS 2.0 + itunes + podcast namespace feeds with lnaddress value blocks
  (podcast:guid UUIDv5 verified against the spec vector)
- streams API with hashed stream keys; MediaMTX http-auth webhook
  (query/password/bearer forms); API poller flips live/ended status
- NIP-53 kind 30311 live events published with the server's nostr identity
- recordings: ffmpeg remux + server-key blossom upload → podcast episode
- 35 vitest tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blossom/config.yml

@@ -0,0 +1,43 @@
+# blossom-server configuration for podpuddle.
+# Uploads require a signed nostr auth event (BUD-01/BUD-02, kind 24242);
+# reads are public so podcast apps can fetch enclosures.
+
+publicDomain: ""
+
+databasePath: data/sqlite.db
+
+dashboard:
+  enabled: false
+
+discovery:
+  nostr:
+    enabled: false
+    relays: []
+  upstream:
+    enabled: false
+    domains: []
+
+storage:
+  backend: local
+  local:
+    dir: ./data/blobs
+  removeWhenNoOwners: false
+
+upload:
+  enabled: true
+  requireAuth: true
+  requirePubkeyInRule: false
+
+media:
+  enabled: false
+
+list:
+  requireAuth: false
+  allowListOthers: true
+
+tor:
+  enabled: false
+
+rules:
+  - type: "*"
+    expiration: 10 years