feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

- docker-compose with Postgres 16 + slim Python API image
- FastAPI app with session middleware, health endpoint, static login page
- Google OAuth (Authlib) with email invite-list whitelist; admin role support
- User + OAuthToken models; refresh tokens encrypted at rest (Fernet)
- Alembic migrations, run automatically on container startup
- Postgres backup/restore scripts for portability between machines

scripts/backup.ps1

@@ -0,0 +1,10 @@
+# Dumps the Subfeed Postgres database to backups\subfeed-<timestamp>.dump (custom format).
+# Run from the project root:  .\scripts\backup.ps1
+$ErrorActionPreference = "Stop"
+$user = if ($env:POSTGRES_USER) { $env:POSTGRES_USER } else { "subfeed" }
+$dbname = if ($env:POSTGRES_DB) { $env:POSTGRES_DB } else { "subfeed" }
+New-Item -ItemType Directory -Force -Path "backups" | Out-Null
+$ts = Get-Date -Format "yyyyMMdd-HHmmss"
+$out = "backups\subfeed-$ts.dump"
+docker compose exec -T db pg_dump -U $user -Fc $dbname | Set-Content -NoNewline -Encoding Byte $out
+Write-Output "Wrote $out"

scripts/backup.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Dumps the Subfeed Postgres database to backups/subfeed-<timestamp>.dump (custom format).
+# Run from the project root:  ./scripts/backup.sh
+set -e
+USER_NAME="${POSTGRES_USER:-subfeed}"
+DB_NAME="${POSTGRES_DB:-subfeed}"
+mkdir -p backups
+TS=$(date +%Y%m%d-%H%M%S)
+OUT="backups/subfeed-$TS.dump"
+docker compose exec -T db pg_dump -U "$USER_NAME" -Fc "$DB_NAME" > "$OUT"
+echo "Wrote $OUT"

scripts/restore.ps1

@@ -0,0 +1,9 @@
+# Restores a Subfeed Postgres dump created by backup.ps1 into the running db container.
+# Usage:  .\scripts\restore.ps1 backups\subfeed-YYYYMMDD-HHMMSS.dump
+param([Parameter(Mandatory = $true)][string]$DumpFile)
+$ErrorActionPreference = "Stop"
+$user = if ($env:POSTGRES_USER) { $env:POSTGRES_USER } else { "subfeed" }
+$dbname = if ($env:POSTGRES_DB) { $env:POSTGRES_DB } else { "subfeed" }
+if (-not (Test-Path $DumpFile)) { throw "Dump file not found: $DumpFile" }
+Get-Content -Encoding Byte $DumpFile | docker compose exec -T db pg_restore -U $user -d $dbname --clean --if-exists
+Write-Output "Restored $DumpFile"

scripts/restore.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Restores a Subfeed Postgres dump created by backup.sh into the running db container.
+# Usage:  ./scripts/restore.sh backups/subfeed-YYYYMMDD-HHMMSS.dump
+set -e
+FILE="$1"
+if [ -z "$FILE" ]; then echo "Usage: restore.sh <dumpfile>"; exit 1; fi
+if [ ! -f "$FILE" ]; then echo "Dump file not found: $FILE"; exit 1; fi
+USER_NAME="${POSTGRES_USER:-subfeed}"
+DB_NAME="${POSTGRES_DB:-subfeed}"
+docker compose exec -T db pg_restore -U "$USER_NAME" -d "$DB_NAME" --clean --if-exists < "$FILE"
+echo "Restored $FILE"