feat(server): podpuddle scaffold + Fastify backend (nostr auth, RSS, streams)

- docker-compose stack: podpuddle + MediaMTX (RTMP/WHIP/HLS) + blossom-server
- NIP-98 nostr-only login with session cookies, replay guard, clock-skew window
- podcasts/episodes CRUD; episodes register browser-uploaded blossom blobs
- RSS 2.0 + itunes + podcast namespace feeds with lnaddress value blocks
  (podcast:guid UUIDv5 verified against the spec vector)
- streams API with hashed stream keys; MediaMTX http-auth webhook
  (query/password/bearer forms); API poller flips live/ended status
- NIP-53 kind 30311 live events published with the server's nostr identity
- recordings: ffmpeg remux + server-key blossom upload → podcast episode
- 35 vitest tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,58 @@
+name: podpuddle
+
+services:
+  podpuddle:
+    build: .
+    container_name: podpuddle
+    restart: unless-stopped
+    ports:
+      - "8095:8095"
+    environment:
+      NODE_ENV: production
+      PORT: "8095"
+      DATA_DIR: /data
+      RECORDINGS_DIR: /recordings
+      PUBLIC_URL: ${PUBLIC_URL:-http://localhost:8095}
+      MEDIAMTX_API_URL: http://mediamtx:9997
+      MEDIAMTX_RTMP_PUBLIC: ${MEDIAMTX_RTMP_PUBLIC:-rtmp://localhost:1935}
+      MEDIAMTX_WHIP_PUBLIC: ${MEDIAMTX_WHIP_PUBLIC:-http://localhost:8889}
+      MEDIAMTX_HLS_PUBLIC: ${MEDIAMTX_HLS_PUBLIC:-http://localhost:8890}
+      BLOSSOM_URL_DEFAULT: ${BLOSSOM_URL_DEFAULT:-http://localhost:8098}
+      NOSTR_RELAYS: ${NOSTR_RELAYS:-wss://relay.damus.io,wss://nos.lol,wss://relay.nostr.band}
+    volumes:
+      - podpuddle-data:/data
+      - mediamtx-recordings:/recordings:ro
+    depends_on:
+      - mediamtx
+      - blossom
+
+  mediamtx:
+    image: bluenviron/mediamtx:1.19.2
+    container_name: podpuddle-mediamtx
+    restart: unless-stopped
+    ports:
+      - "1935:1935"        # RTMP ingest
+      - "8889:8889"        # WebRTC / WHIP
+      - "8189:8189/udp"    # WebRTC ICE
+      - "8890:8888"        # HLS (host 8890; 8888 kept free for other apps)
+    environment:
+      # Browsers need a reachable ICE host candidate; set PUBLIC_HOST in .env
+      MTX_WEBRTCADDITIONALHOSTS: ${PUBLIC_HOST:-localhost}
+    volumes:
+      - ./mediamtx/mediamtx.yml:/mediamtx.yml:ro
+      - mediamtx-recordings:/recordings
+
+  blossom:
+    image: ghcr.io/hzrd149/blossom-server:4
+    container_name: podpuddle-blossom
+    restart: unless-stopped
+    ports:
+      - "8098:3000"
+    volumes:
+      - ./blossom/config.yml:/app/config.yml:ro
+      - blossom-data:/app/data
+
+volumes:
+  podpuddle-data:
+  mediamtx-recordings:
+  blossom-data: