chore(release): v0.22.0 — Download Center worker/sidecar in all composes + docs

Prep the Download Center epic (Phase 1 + editor + share) for prod/self-host:
- Dockerfile: create /downloads owned by appuser so a named-volume mount is writable (prod Linux).
- docker-compose.{home,selfhost,yml}: add the 'worker' (yt-dlp/ffmpeg job loop) + 'bgutil-pot'
  (PO-token) services + a downloads mount (DOWNLOAD_ROOT, WORKER_ENABLED). Media defaults to a
  named volume; DOWNLOAD_HOST_PATH points it at a host dir (e.g. a Plex-readable folder).
- README / docs/self-hosting.md / .env.example / install.{sh,ps1}: document the Download Center,
  the two extra containers, and DOWNLOAD_HOST_PATH.
- VERSION 0.22.0 + releaseNotes entry.

docker-compose.selfhost.yml

@@ -37,6 +37,10 @@ services:
       DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-siftlode}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-siftlode}
       # This instance owns the background scheduler (single writer).
       SCHEDULER_ENABLED: "true"
+      # Download center: the API serves finished files + builds filmstrips; the worker (below) runs
+      # the yt-dlp job loop. Read-only root is fine — it only writes to the /downloads mount + tmpfs.
+      DOWNLOAD_ROOT: /downloads
+      WORKER_ENABLED: "false"
     depends_on:
       db:
         condition: service_healthy
@@ -45,6 +49,10 @@ services:
       # Reachable on the host's LAN at http://<host>:8080. Put a reverse proxy (Caddy/Nginx) in
       # front for HTTPS / public exposure — and set OAUTH_REDIRECT_URL to the https URL.
       - "${HTTP_PORT:-8080}:8000"
+    volumes:
+      # Downloaded media. Defaults to a Docker-managed named volume; set DOWNLOAD_HOST_PATH in .env
+      # to a host directory (e.g. one your Plex server reads) to keep the Plex-style tree there.
+      - ${DOWNLOAD_HOST_PATH:-siftlode_downloads}:/downloads
     security_opt:
       - no-new-privileges:true
     cap_drop:
@@ -60,8 +68,48 @@ services:
       start_period: 30s
     restart: unless-stopped
 
+  # Download worker: same image, runs the yt-dlp / ffmpeg job loop instead of the API. Shares the
+  # DB (job queue) and the downloads mount with the API. Not read-only (yt-dlp/deno/ffmpeg write to
+  # $HOME caches + the staging dir).
+  worker:
+    image: forge.b1fr0st.eu/peter/siftlode:${IMAGE_TAG:-latest}
+    command: ["python", "-m", "app.worker"]
+    env_file:
+      - .env
+    environment:
+      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-siftlode}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-siftlode}
+      SCHEDULER_ENABLED: "false"
+      DOWNLOAD_ROOT: /downloads
+      WORKER_ENABLED: "true"
+    depends_on:
+      db:
+        condition: service_healthy
+      bgutil-pot:
+        condition: service_started
+    networks: [internal]
+    volumes:
+      - ${DOWNLOAD_HOST_PATH:-siftlode_downloads}:/downloads
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    tmpfs:
+      - /tmp
+    restart: unless-stopped
+
+  # PO-token provider sidecar: mints YouTube Proof-of-Origin tokens so the worker beats bot-detection
+  # and unlocks high-quality formats (reached at http://bgutil-pot:4416, the config default).
+  bgutil-pot:
+    image: brainicism/bgutil-ytdlp-pot-provider:1.3.1
+    init: true
+    networks: [internal]
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+
 volumes:
   siftlode_pgdata:
+  siftlode_downloads:
 
 networks:
   internal: