feat: bootstrap MediaStationGo (Go + React rewrite of MediaStation)

Adopt the cropflre/nowen-video tech stack and rebuild the project from
scratch:

  - Backend: Go 1.25 + Gin + GORM + SQLite (WAL) + JWT + WebSocket hub.
    Layered packages config / database / model / repository / service /
    middleware / handler. Default admin (admin/admin123) seeded on first
    run; /api routes for auth, libraries, media, stream and admin
    panels. WebSocket scan-progress events at /api/ws.
  - Frontend: React 18 + Vite 5 + Tailwind 3.4 + Zustand + axios +
    react-router 6 + lucide-react + framer-motion + hls.js. Pages for
    Login / Home / Library / Search / MediaDetail / Player / Admin
    (Library, Users, Settings tabs).
  - Distribution: multi-arch Dockerfile (frontend -> backend -> Alpine
    runtime), docker-compose.yml, GitHub Actions for CI and GHCR
    publish, Makefile, env-prefixed config (MEDIASTATION_*).
  - Docs: README, CONTRIBUTING, .env.example, config.example.yaml.

Backend builds, vets and tests pass. Frontend builds via tsc -b && vite
build (250 kB JS / 16 kB CSS, gzipped 84 / 4 kB).

docker-compose.yml

@@ -0,0 +1,52 @@
+version: '3.8'
+
+# ============================================================================
+# MediaStationGo — recommended NAS deployment.
+#
+# 1. Edit the volume mappings under `volumes:` so that /media points at your
+#    actual library root (e.g. /volume1/Media).
+# 2. (Optional) set MEDIASTATION_SECRETS_JWT_SECRET to a strong random string;
+#    otherwise one is auto-generated and persisted to /data/.jwt_secret.
+# 3. `docker compose up -d` and visit http://<host>:8080 (admin / admin123).
+# ============================================================================
+
+services:
+  mediastation-go:
+    build:
+      context: .
+    image: ghcr.io/shukebta/mediastation-go:latest
+    container_name: mediastation-go
+    restart: unless-stopped
+
+    ports:
+      - "8080:8080"
+
+    volumes:
+      - ./data:/data
+      - ./cache:/cache
+      # Mount your media library into /media. Read-only is fine.
+      # - /volume1/Media:/media:ro
+
+    environment:
+      MEDIASTATION_APP_PORT: 8080
+      MEDIASTATION_APP_DATA_DIR: /data
+      MEDIASTATION_APP_WEB_DIR: /app/web/dist
+      MEDIASTATION_DATABASE_DB_PATH: /data/mediastation.db
+      MEDIASTATION_CACHE_CACHE_DIR: /cache
+      MEDIASTATION_LOGGING_LEVEL: info
+      # MEDIASTATION_SECRETS_JWT_SECRET: change-me-to-a-strong-random-string
+      # MEDIASTATION_APP_CORS_ORIGINS: '["https://media.example.com"]'
+      PUID: "1000"
+      PGID: "1000"
+      TZ: Asia/Shanghai
+
+    # Hardware-accelerated transcoding (uncomment when you have an Intel iGPU).
+    # devices:
+    #   - /dev/dri:/dev/dri
+
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/api/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s