Add the initial mediamark app

Single Go binary serving the API and an embedded keyboard-first UI for
promoting fafflix titles into the cheeztv kids tree via hardlinks.

- internal/library: hardlink sync, idempotent re-runs, drift reporting,
  strict single-path-element name validation as the traversal guard
- internal/arr: minimal sonarr/radarr v3 client with a 60s list cache and
  a key-brokered poster proxy
- internal/auth: server-side Authentik group enforcement on every route
- internal/server: library JSON API, art proxy, health probes, SPA
- ui: two-tile landing page, fuzzy-filtered title list, detail panel
- Makefile, Dockerfile, .woodpecker pipelines, pre-commit config

cmd/mediamark/main.go

@@ -0,0 +1,68 @@
+// Command mediamark serves the media-marking web app: a single binary carrying
+// its own UI that hardlinks titles from the fafflix library into the cheeztv
+// kids tree.
+package main
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"git.unkin.net/unkin/mediamark/internal/arr"
+	"git.unkin.net/unkin/mediamark/internal/config"
+	"git.unkin.net/unkin/mediamark/internal/library"
+	"git.unkin.net/unkin/mediamark/internal/server"
+	"git.unkin.net/unkin/mediamark/ui"
+)
+
+var version = "dev"
+
+func main() {
+	log := slog.New(slog.NewJSONHandler(os.Stdout, nil))
+
+	cfg, err := config.Load()
+	if err != nil {
+		log.Error("config", "err", err)
+		os.Exit(1)
+	}
+
+	keys := arr.FileKeys(cfg.KeysDir)
+	lib := library.New(cfg.MediaRoot)
+	arrs := map[library.Section]*arr.Client{
+		library.SectionTVSeries: arr.New(arr.KindSonarr, cfg.SonarrURL, keys),
+		library.SectionMovies:   arr.New(arr.KindRadarr, cfg.RadarrURL, keys),
+	}
+
+	srv := &http.Server{
+		Addr:              cfg.Listen,
+		Handler:           server.New(cfg, lib, arrs, ui.Assets(), log).Handler(),
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	go func() {
+		log.Info("mediamark listening",
+			"addr", cfg.Listen, "version", version,
+			"mediaRoot", cfg.MediaRoot, "allowedGroups", cfg.AllowedGroups)
+		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Error("serve", "err", err)
+			os.Exit(1)
+		}
+	}()
+
+	<-ctx.Done()
+	log.Info("shutting down")
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	if err := srv.Shutdown(shutdownCtx); err != nil {
+		log.Error("shutdown", "err", err)
+		os.Exit(1)
+	}
+}