feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

- docker-compose with Postgres 16 + slim Python API image
- FastAPI app with session middleware, health endpoint, static login page
- Google OAuth (Authlib) with email invite-list whitelist; admin role support
- User + OAuthToken models; refresh tokens encrypted at rest (Fernet)
- Alembic migrations, run automatically on container startup
- Postgres backup/restore scripts for portability between machines

scripts/backup.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Dumps the Subfeed Postgres database to backups/subfeed-<timestamp>.dump (custom format).
+# Run from the project root:  ./scripts/backup.sh
+set -e
+USER_NAME="${POSTGRES_USER:-subfeed}"
+DB_NAME="${POSTGRES_DB:-subfeed}"
+mkdir -p backups
+TS=$(date +%Y%m%d-%H%M%S)
+OUT="backups/subfeed-$TS.dump"
+docker compose exec -T db pg_dump -U "$USER_NAME" -Fc "$DB_NAME" > "$OUT"
+echo "Wrote $OUT"