feat: bootstrap MediaStationGo (Go + React rewrite of MediaStation)

Adopt the cropflre/nowen-video tech stack and rebuild the project from
scratch:

  - Backend: Go 1.25 + Gin + GORM + SQLite (WAL) + JWT + WebSocket hub.
    Layered packages config / database / model / repository / service /
    middleware / handler. Default admin (admin/admin123) seeded on first
    run; /api routes for auth, libraries, media, stream and admin
    panels. WebSocket scan-progress events at /api/ws.
  - Frontend: React 18 + Vite 5 + Tailwind 3.4 + Zustand + axios +
    react-router 6 + lucide-react + framer-motion + hls.js. Pages for
    Login / Home / Library / Search / MediaDetail / Player / Admin
    (Library, Users, Settings tabs).
  - Distribution: multi-arch Dockerfile (frontend -> backend -> Alpine
    runtime), docker-compose.yml, GitHub Actions for CI and GHCR
    publish, Makefile, env-prefixed config (MEDIASTATION_*).
  - Docs: README, CONTRIBUTING, .env.example, config.example.yaml.

Backend builds, vets and tests pass. Frontend builds via tsc -b && vite
build (250 kB JS / 16 kB CSS, gzipped 84 / 4 kB).

web/src/api/admin.ts

@@ -0,0 +1,15 @@
+import { api } from './client'
+import type { AccessLog, Setting, User } from '../types'
+
+export const adminAPI = {
+  listUsers: () => api.get<User[]>('/admin/users').then((r) => r.data),
+
+  deleteUser: (id: string) => api.delete(`/admin/users/${id}`).then((r) => r.data),
+
+  listSettings: () => api.get<Setting[]>('/admin/settings').then((r) => r.data),
+
+  updateSetting: (key: string, value: string) =>
+    api.put('/admin/settings', { key, value }).then((r) => r.data),
+
+  recentLogs: () => api.get<AccessLog[]>('/admin/logs').then((r) => r.data),
+}

web/src/api/auth.ts

@@ -0,0 +1,22 @@
+import { api } from './client'
+import type { User } from '../types'
+
+export interface LoginResponse {
+  token: string
+  user: User
+}
+
+export const authAPI = {
+  login: (username: string, password: string) =>
+    api.post<LoginResponse>('/auth/login', { username, password }).then((r) => r.data),
+
+  register: (username: string, password: string) =>
+    api.post<User>('/auth/register', { username, password }).then((r) => r.data),
+
+  me: () => api.get<User>('/me').then((r) => r.data),
+
+  changePassword: (oldPassword: string, newPassword: string) =>
+    api
+      .post('/me/password', { old_password: oldPassword, new_password: newPassword })
+      .then((r) => r.data),
+}

web/src/api/client.ts

@@ -0,0 +1,39 @@
+import axios, { AxiosError } from 'axios'
+
+import { useAuthStore } from '../stores/auth'
+
+// Single axios instance used by every API helper. Adds the JWT to outgoing
+// requests and routes 401s back to the login page.
+export const api = axios.create({
+  baseURL: '/api',
+  timeout: 30000,
+})
+
+api.interceptors.request.use((config) => {
+  const token = useAuthStore.getState().token
+  if (token) {
+    config.headers = config.headers ?? {}
+    config.headers.Authorization = `Bearer ${token}`
+  }
+  return config
+})
+
+api.interceptors.response.use(
+  (resp) => resp,
+  (err: AxiosError) => {
+    if (err.response?.status === 401) {
+      useAuthStore.getState().logout()
+      if (typeof window !== 'undefined' && window.location.pathname !== '/login') {
+        window.location.href = '/login'
+      }
+    }
+    return Promise.reject(err)
+  },
+)
+
+// Helper that returns a streaming URL with the JWT appended as a query
+// parameter so <video src> works without an Authorization header.
+export function streamURL(mediaId: string): string {
+  const token = useAuthStore.getState().token ?? ''
+  return `/api/stream/${encodeURIComponent(mediaId)}?token=${encodeURIComponent(token)}`
+}

web/src/api/library.ts

@@ -0,0 +1,35 @@
+import { api } from './client'
+import type { Library, Media, ScanResult } from '../types'
+
+export interface MediaPage {
+  items: Media[]
+  total: number
+  page: number
+  page_size: number
+}
+
+export const libraryAPI = {
+  list: () => api.get<Library[]>('/libraries').then((r) => r.data),
+
+  create: (name: string, path: string, type: string) =>
+    api.post<Library>('/libraries', { name, path, type }).then((r) => r.data),
+
+  remove: (id: string) => api.delete(`/libraries/${id}`).then((r) => r.data),
+
+  scan: (id: string) =>
+    api.post<ScanResult>(`/libraries/${id}/scan`).then((r) => r.data),
+
+  listMedia: (id: string, page = 1, pageSize = 50) =>
+    api
+      .get<MediaPage>(`/libraries/${id}/media`, {
+        params: { page, page_size: pageSize },
+      })
+      .then((r) => r.data),
+}
+
+export const mediaAPI = {
+  search: (q: string, limit = 50) =>
+    api.get<{ items: Media[] }>('/media', { params: { q, limit } }).then((r) => r.data),
+
+  get: (id: string) => api.get<Media>(`/media/${id}`).then((r) => r.data),
+}