feat: bootstrap MediaStationGo (Go + React rewrite of MediaStation)

Adopt the cropflre/nowen-video tech stack and rebuild the project from
scratch:

  - Backend: Go 1.25 + Gin + GORM + SQLite (WAL) + JWT + WebSocket hub.
    Layered packages config / database / model / repository / service /
    middleware / handler. Default admin (admin/admin123) seeded on first
    run; /api routes for auth, libraries, media, stream and admin
    panels. WebSocket scan-progress events at /api/ws.
  - Frontend: React 18 + Vite 5 + Tailwind 3.4 + Zustand + axios +
    react-router 6 + lucide-react + framer-motion + hls.js. Pages for
    Login / Home / Library / Search / MediaDetail / Player / Admin
    (Library, Users, Settings tabs).
  - Distribution: multi-arch Dockerfile (frontend -> backend -> Alpine
    runtime), docker-compose.yml, GitHub Actions for CI and GHCR
    publish, Makefile, env-prefixed config (MEDIASTATION_*).
  - Docs: README, CONTRIBUTING, .env.example, config.example.yaml.

Backend builds, vets and tests pass. Frontend builds via tsc -b && vite
build (250 kB JS / 16 kB CSS, gzipped 84 / 4 kB).

.env.example

@@ -0,0 +1,21 @@
+# MediaStationGo — environment variables (copy to `.env` if needed).
+#
+# Every config key is overridable via MEDIASTATION_<UPPER_KEY>=value.
+# Below are the values most people change.
+
+MEDIASTATION_APP_PORT=8080
+MEDIASTATION_APP_DEBUG=false
+MEDIASTATION_APP_DATA_DIR=./data
+
+# Comma-or-array allow-list. Empty = allow * (dev).
+# MEDIASTATION_APP_CORS_ORIGINS=https://media.example.com
+
+# Override the seeded admin password (used only when no admin exists).
+ADMIN_INITIAL_PASSWORD=admin123
+
+# Strong random JWT secret (auto-generated when empty).
+# MEDIASTATION_SECRETS_JWT_SECRET=please-change-me
+
+# 3rd-party scrape providers.
+# MEDIASTATION_SECRETS_TMDB_API_KEY=
+# MEDIASTATION_SECRETS_BANGUMI_ACCESS_TOKEN=