chore(release): v0.22.0 — Download Center worker/sidecar in all composes + docs

Prep the Download Center epic (Phase 1 + editor + share) for prod/self-host:
- Dockerfile: create /downloads owned by appuser so a named-volume mount is writable (prod Linux).
- docker-compose.{home,selfhost,yml}: add the 'worker' (yt-dlp/ffmpeg job loop) + 'bgutil-pot'
  (PO-token) services + a downloads mount (DOWNLOAD_ROOT, WORKER_ENABLED). Media defaults to a
  named volume; DOWNLOAD_HOST_PATH points it at a host dir (e.g. a Plex-readable folder).
- README / docs/self-hosting.md / .env.example / install.{sh,ps1}: document the Download Center,
  the two extra containers, and DOWNLOAD_HOST_PATH.
- VERSION 0.22.0 + releaseNotes entry.

Dockerfile

@@ -54,7 +54,13 @@ COPY backend/ .
 COPY VERSION ./VERSION
 COPY --from=frontend /fe/dist ./app/static_spa
 
-RUN adduser --disabled-password --gecos "" appuser && chown -R appuser /app
+# Create the download-center mount point owned by the app user, so a fresh named volume mounted
+# at /downloads inherits appuser ownership (Docker copies the image dir's ownership into a new
+# empty volume) — the worker/API can then write there without a manual chown. A bind mount to a
+# host path instead needs that path writable by this uid (see docs/self-hosting.md).
+RUN adduser --disabled-password --gecos "" appuser \
+    && mkdir -p /downloads \
+    && chown -R appuser /app /downloads
 USER appuser
 
 EXPOSE 8000