Stage 0: migrate pipeline scripts from /opt/sldl, scaffold repo

Moves all ~30 pipeline scripts, configs, and the vendored sldl binary into
this repo (source /opt/sldl left untouched). Removes all docker exec/docker
compose dependencies now that beets and sldl run in-process/as a subprocess
of this container instead of via soulbeet/on-demand sldl containers.
Replaces hardcoded host paths, Navidrome credentials, and Spotify credential
sourcing with env-var-driven paths and shared credential loaders. Adds
Dockerfile, entrypoint.sh, requirements.txt, docker-compose.snippet.yml, and
the initial app DB schema.

pipeline/lib/notify-telegram.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# notify-telegram.sh — send a message to the configured Telegram chat.
+# Sources credentials from $ALEMBIC_CONFIG_DIR/pipeline/telegram/notify.env (chmod 600).
+#
+# Usage:
+#   echo "single line message" | notify-telegram.sh
+#   notify-telegram.sh "single line message"
+#   notify-telegram.sh < ${ALEMBIC_CONFIG_DIR:-/config}/logs/STATUS.log
+#
+# Telegram messages are capped at 4096 chars. Anything longer is truncated
+# with a "...<truncated>" tail. Returns exit 0 on send-OK, non-zero otherwise.
+
+set -u
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+CONFIG="${ALEMBIC_CONFIG_DIR:-/config}/pipeline/telegram/notify.env"
+if [[ ! -f "$CONFIG" ]]; then
+  echo "[notify-telegram] no config at $CONFIG" >&2
+  exit 1
+fi
+# shellcheck disable=SC1090
+source "$CONFIG"
+: "${TG_BOT_TOKEN:?TG_BOT_TOKEN missing}"
+: "${TG_CHAT_ID:?TG_CHAT_ID missing}"
+
+# Read message from arg or stdin
+if [[ $# -ge 1 ]]; then
+  MSG="$*"
+else
+  MSG=$(cat)
+fi
+
+# Telegram caps at 4096 chars (UTF-8 codepoints). Trim conservatively at 3900.
+# Use python for proper UTF-8 length handling.
+MSG=$(python3 -c "
+import sys
+s = sys.argv[1]
+if len(s) > 3900:
+    s = s[:3900] + '\n...<truncated>'
+print(s, end='')
+" "$MSG")
+
+# Send via Bot API. Disable web-page preview and use plain text (no parse_mode)
+# so log content with special chars doesn't get interpreted as Markdown.
+resp=$(curl -s --max-time 15 -X POST \
+  "https://api.telegram.org/bot${TG_BOT_TOKEN}/sendMessage" \
+  --data-urlencode "chat_id=${TG_CHAT_ID}" \
+  --data-urlencode "text=${MSG}" \
+  --data-urlencode "disable_web_page_preview=true")
+
+ok=$(echo "$resp" | python3 -c "import sys,json;print(json.load(sys.stdin).get('ok',False))" 2>/dev/null || echo False)
+if [[ "$ok" != "True" ]]; then
+  echo "[notify-telegram] send failed: $resp" >&2
+  exit 2
+fi
+exit 0