feat(server): podpuddle scaffold + Fastify backend (nostr auth, RSS, streams)

- docker-compose stack: podpuddle + MediaMTX (RTMP/WHIP/HLS) + blossom-server
- NIP-98 nostr-only login with session cookies, replay guard, clock-skew window
- podcasts/episodes CRUD; episodes register browser-uploaded blossom blobs
- RSS 2.0 + itunes + podcast namespace feeds with lnaddress value blocks
  (podcast:guid UUIDv5 verified against the spec vector)
- streams API with hashed stream keys; MediaMTX http-auth webhook
  (query/password/bearer forms); API poller flips live/ended status
- NIP-53 kind 30311 live events published with the server's nostr identity
- recordings: ffmpeg remux + server-key blossom upload → podcast episode
- 35 vitest tests green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mediamtx/mediamtx.yml

@@ -0,0 +1,48 @@
+# MediaMTX configuration for podpuddle.
+# Ingest: RTMP (OBS) + WebRTC/WHIP (browser). Output: HLS. Publish auth is
+# delegated to podpuddle via HTTP; stream status is polled from the API.
+
+logLevel: info
+
+api: yes
+apiAddress: :9997
+
+# ---- authentication ------------------------------------------------------
+authMethod: http
+authHTTPAddress: http://podpuddle:8095/api/mediamtx/auth
+authHTTPExclude:
+  - action: api
+  - action: metrics
+  - action: pprof
+
+# ---- protocols -----------------------------------------------------------
+rtsp: no
+srt: no
+
+rtmp: yes
+rtmpAddress: :1935
+
+hls: yes
+hlsAddress: :8888
+hlsVariant: lowLatency
+hlsAlwaysRemux: yes
+hlsAllowOrigin: "*"
+
+webrtc: yes
+webrtcAddress: :8889
+webrtcLocalUDPAddress: :8189
+webrtcAllowOrigin: "*"
+
+# ---- recording -----------------------------------------------------------
+pathDefaults:
+  record: yes
+  recordPath: /recordings/%path/%Y-%m-%d_%H-%M-%S-%f
+  recordFormat: fmp4
+  recordPartDuration: 1s
+  recordSegmentDuration: 1h
+  recordDeleteAfter: 168h
+
+paths:
+  # Streams live at live/<streamId>; publish requires the stream secret,
+  # which podpuddle checks in the auth webhook.
+  "~^live/[A-Za-z0-9]+$": {}