feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

- docker-compose with Postgres 16 + slim Python API image
- FastAPI app with session middleware, health endpoint, static login page
- Google OAuth (Authlib) with email invite-list whitelist; admin role support
- User + OAuthToken models; refresh tokens encrypted at rest (Fernet)
- Alembic migrations, run automatically on container startup
- Postgres backup/restore scripts for portability between machines

scripts/restore.ps1

@@ -0,0 +1,9 @@
+# Restores a Subfeed Postgres dump created by backup.ps1 into the running db container.
+# Usage:  .\scripts\restore.ps1 backups\subfeed-YYYYMMDD-HHMMSS.dump
+param([Parameter(Mandatory = $true)][string]$DumpFile)
+$ErrorActionPreference = "Stop"
+$user = if ($env:POSTGRES_USER) { $env:POSTGRES_USER } else { "subfeed" }
+$dbname = if ($env:POSTGRES_DB) { $env:POSTGRES_DB } else { "subfeed" }
+if (-not (Test-Path $DumpFile)) { throw "Dump file not found: $DumpFile" }
+Get-Content -Encoding Byte $DumpFile | docker compose exec -T db pg_restore -U $user -d $dbname --clean --if-exists
+Write-Output "Restored $DumpFile"