Add the initial mediamark app

Single Go binary serving the API and an embedded keyboard-first UI for
promoting fafflix titles into the cheeztv kids tree via hardlinks.

- internal/library: hardlink sync, idempotent re-runs, drift reporting,
  strict single-path-element name validation as the traversal guard
- internal/arr: minimal sonarr/radarr v3 client with a 60s list cache and
  a key-brokered poster proxy
- internal/auth: server-side Authentik group enforcement on every route
- internal/server: library JSON API, art proxy, health probes, SPA
- ui: two-tile landing page, fuzzy-filtered title list, detail panel
- Makefile, Dockerfile, .woodpecker pipelines, pre-commit config

.woodpecker/build.yaml

@@ -0,0 +1,23 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: docker-build
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
+    settings:
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/mediamark
+      dockerfile: Dockerfile
+      dry_run: true
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
+    backend_options:
+      kubernetes:
+        serviceAccountName: mediamark-ci
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2

.woodpecker/docker.yaml

@@ -0,0 +1,29 @@
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+steps:
+  - name: docker
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest
+    settings:
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/mediamark
+      dockerfile: Dockerfile
+      build_args:
+        VERSION: ${CI_COMMIT_TAG}
+      buildkit_config: |
+        [registry."artifactapi.k8s.syd1.au.unkin.net"]
+          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
+      tags:
+        - ${CI_COMMIT_TAG}
+        - latest
+    backend_options:
+      kubernetes:
+        serviceAccountName: mediamark-ci
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2

.woodpecker/pre-commit.yaml

@@ -0,0 +1,19 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: golang:1.25
+    commands:
+      - test -z "$(gofmt -l .)"
+      - go vet ./...
+    backend_options:
+      kubernetes:
+        serviceAccountName: mediamark-ci
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/test.yaml

@@ -0,0 +1,18 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: test
+    image: golang:1.25
+    commands:
+      - go test -race -count=1 ./...
+    backend_options:
+      kubernetes:
+        serviceAccountName: mediamark-ci
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2