feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

- docker-compose with Postgres 16 + slim Python API image
- FastAPI app with session middleware, health endpoint, static login page
- Google OAuth (Authlib) with email invite-list whitelist; admin role support
- User + OAuthToken models; refresh tokens encrypted at rest (Fernet)
- Alembic migrations, run automatically on container startup
- Postgres backup/restore scripts for portability between machines

scripts/backup.ps1

@@ -0,0 +1,10 @@
+# Dumps the Subfeed Postgres database to backups\subfeed-<timestamp>.dump (custom format).
+# Run from the project root:  .\scripts\backup.ps1
+$ErrorActionPreference = "Stop"
+$user = if ($env:POSTGRES_USER) { $env:POSTGRES_USER } else { "subfeed" }
+$dbname = if ($env:POSTGRES_DB) { $env:POSTGRES_DB } else { "subfeed" }
+New-Item -ItemType Directory -Force -Path "backups" | Out-Null
+$ts = Get-Date -Format "yyyyMMdd-HHmmss"
+$out = "backups\subfeed-$ts.dump"
+docker compose exec -T db pg_dump -U $user -Fc $dbname | Set-Content -NoNewline -Encoding Byte $out
+Write-Output "Wrote $out"