chore(release): v0.22.0 — Download Center worker/sidecar in all composes + docs

Prep the Download Center epic (Phase 1 + editor + share) for prod/self-host:
- Dockerfile: create /downloads owned by appuser so a named-volume mount is writable (prod Linux).
- docker-compose.{home,selfhost,yml}: add the 'worker' (yt-dlp/ffmpeg job loop) + 'bgutil-pot'
  (PO-token) services + a downloads mount (DOWNLOAD_ROOT, WORKER_ENABLED). Media defaults to a
  named volume; DOWNLOAD_HOST_PATH points it at a host dir (e.g. a Plex-readable folder).
- README / docs/self-hosting.md / .env.example / install.{sh,ps1}: document the Download Center,
  the two extra containers, and DOWNLOAD_HOST_PATH.
- VERSION 0.22.0 + releaseNotes entry.

docker-compose.yml

@@ -25,11 +25,19 @@ services:
     env_file: .env
     environment:
       DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-siftlode}:${POSTGRES_PASSWORD:-siftlode}@db:5432/${POSTGRES_DB:-siftlode}
+      # Download center: the API serves finished files + builds filmstrips; the worker (below) runs
+      # the yt-dlp job loop.
+      DOWNLOAD_ROOT: /downloads
+      WORKER_ENABLED: "false"
     depends_on:
       db:
         condition: service_healthy
     ports:
       - "${APP_PORT:-8080}:8000"
+    volumes:
+      # Downloaded media. Defaults to a Docker-managed named volume; set DOWNLOAD_HOST_PATH in .env
+      # to a host directory (e.g. one your Plex server reads) to keep the Plex-style tree there.
+      - ${DOWNLOAD_HOST_PATH:-downloads}:/downloads
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; exit(0 if urllib.request.urlopen('http://localhost:8000/healthz').status == 200 else 1)"]
       interval: 15s
@@ -38,5 +46,39 @@ services:
       start_period: 25s
     restart: unless-stopped
 
+  # Download worker: same image, runs the yt-dlp / ffmpeg job loop instead of the API. Shares the
+  # DB (job queue) + the downloads mount with the API.
+  worker:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        APP_VERSION: ${APP_VERSION:-dev}
+        GIT_SHA: ${GIT_SHA:-unknown}
+        BUILD_DATE: ${BUILD_DATE:-}
+    command: ["python", "-m", "app.worker"]
+    env_file: .env
+    environment:
+      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-siftlode}:${POSTGRES_PASSWORD:-siftlode}@db:5432/${POSTGRES_DB:-siftlode}
+      SCHEDULER_ENABLED: "false"
+      DOWNLOAD_ROOT: /downloads
+      WORKER_ENABLED: "true"
+    depends_on:
+      db:
+        condition: service_healthy
+      bgutil-pot:
+        condition: service_started
+    volumes:
+      - ${DOWNLOAD_HOST_PATH:-downloads}:/downloads
+    restart: unless-stopped
+
+  # PO-token provider sidecar: mints YouTube Proof-of-Origin tokens so the worker beats bot-detection
+  # and unlocks high-quality formats (reached at http://bgutil-pot:4416, the config default).
+  bgutil-pot:
+    image: brainicism/bgutil-ytdlp-pot-provider:1.3.1
+    init: true
+    restart: unless-stopped
+
 volumes:
   pgdata:
+  downloads: