feat(downloads): M1 — schema, config, worker container, deps

- models: MediaAsset (shared file cache, unique on source+format_sig), DownloadJob
  (per-user request), DownloadProfile (presets), DownloadShare (ACL), DownloadQuota
- migrations 0036 (5 tables) + 0037 (6 builtin presets)
- sysconfig 'downloads' group (per-user defaults, retention/GC, layout, worker concurrency)
- config: DOWNLOAD_ROOT / WORKER_ENABLED env + download defaults
- deps: yt-dlp in requirements, ffmpeg in Dockerfile runtime stage
- worker: dedicated container (python -m app.worker), thin idle entry (loop lands in M2)
- localdev compose: worker service + downloads bind-mount; gitignore downloads/

docker-compose.localdev.yml

@@ -43,6 +43,9 @@ services:
       DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-siftlode}:${POSTGRES_PASSWORD:-siftlode}@db:5432/${POSTGRES_DB:-siftlode}
       # This instance owns its scheduler now (its own DB, so no double-write concern).
       SCHEDULER_ENABLED: "true"
+      # Download center: the API serves finished files (it does NOT run the worker loop).
+      DOWNLOAD_ROOT: /downloads
+      WORKER_ENABLED: "false"
     depends_on:
       db:
         condition: service_healthy
@@ -51,6 +54,37 @@ services:
       - apparmor:unconfined
     ports:
       - "${APP_PORT:-8080}:8000"
+    volumes:
+      # Downloaded media lives on the host so you can inspect the generated Plex tree.
+      # Gitignored. The worker writes here; the API reads it to serve local downloads.
+      - ./downloads:/downloads
+    restart: unless-stopped
+
+  # Dedicated download worker: same image, runs the yt-dlp job loop instead of the API.
+  # It shares the DB (job queue) and the downloads mount with the API.
+  worker:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        APP_VERSION: ${APP_VERSION:-dev}
+        GIT_SHA: ${GIT_SHA:-unknown}
+        BUILD_DATE: ${BUILD_DATE:-}
+    command: ["python", "-m", "app.worker"]
+    env_file: .env
+    environment:
+      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-siftlode}:${POSTGRES_PASSWORD:-siftlode}@db:5432/${POSTGRES_DB:-siftlode}
+      # The worker must not also run the scheduler; the API owns that.
+      SCHEDULER_ENABLED: "false"
+      DOWNLOAD_ROOT: /downloads
+      WORKER_ENABLED: "true"
+    depends_on:
+      db:
+        condition: service_healthy
+    security_opt:
+      - apparmor:unconfined
+    volumes:
+      - ./downloads:/downloads
     restart: unless-stopped
 
 volumes: