feat(deploy): shared database + scheduler split for the server 24/7 backfill

Add a server compose (full stack, Postgres on the LAN, scheduler on, host-visible
pgdata bind mount) and a localdev compose (webapp only, no DB, scheduler off) that
points at the shared database. Document the shared-database topology, the
exactly-one-scheduler rule, and YOUTUBE_API_KEY for unattended backfill that does
not depend on a 7-day OAuth refresh token.

.env.example

@@ -28,3 +28,23 @@ ADMIN_EMAILS=
 
 # Optional: origin of a separately-served frontend dev server (enables CORS). Leave empty in production.
 FRONTEND_ORIGIN=
+
+# Optional YouTube Data API key (Google Cloud Console -> Credentials -> Create API key).
+# When set, all public reads (channels/videos/playlist backfill + enrichment) use the key
+# instead of a user's OAuth token, so 24/7 backfill never depends on a refresh token that
+# would otherwise expire (Google expires refresh tokens after 7 days while the OAuth consent
+# screen is in "Testing"). Strongly recommended for the always-on server instance.
+YOUTUBE_API_KEY=
+
+# --- Deployment role ---
+# DATABASE_URL is set automatically by docker-compose.yml / docker-compose.server.yml to the
+# bundled `db` service. Override it only for local dev against the central server DB, e.g.:
+#   DATABASE_URL=postgresql+psycopg://subfeed:<password>@your-db-host:5432/subfeed
+# Exactly one instance may run the background scheduler. The central server keeps it on; every
+# other instance (local dev, etc.) must set SCHEDULER_ENABLED=false. The compose files set this
+# for you (server=true via docker-compose.server.yml, local=false via docker-compose.localdev.yml).
+SCHEDULER_ENABLED=true
+
+# On the central server, set this so backup.sh / restore.sh and plain `docker compose` commands
+# target the server stack automatically:
+#   COMPOSE_FILE=docker-compose.server.yml