Add the initial mediamark app

Single Go binary serving the API and an embedded keyboard-first UI for
promoting fafflix titles into the cheeztv kids tree via hardlinks.

- internal/library: hardlink sync, idempotent re-runs, drift reporting,
  strict single-path-element name validation as the traversal guard
- internal/arr: minimal sonarr/radarr v3 client with a 60s list cache and
  a key-brokered poster proxy
- internal/auth: server-side Authentik group enforcement on every route
- internal/server: library JSON API, art proxy, health probes, SPA
- ui: two-tile landing page, fuzzy-filtered title list, detail panel
- Makefile, Dockerfile, .woodpecker pipelines, pre-commit config

ui/embed.go

@@ -0,0 +1,19 @@
+// Package ui embeds the static mediamark assets.
+package ui
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed static
+var embedded embed.FS
+
+// Assets returns the static asset filesystem rooted at the asset directory.
+func Assets() fs.FS {
+	sub, err := fs.Sub(embedded, "static")
+	if err != nil {
+		panic(err)
+	}
+	return sub
+}