Security hardening and first-run/portability improvements

Security (P0):
- Remove committed session-secret default; auto-generate and persist a
  random secret to the config volume when SESSION_SECRET is unset
  (prevents forgeable session cookies / auth bypass).
- Validate playlist names to a safe charset and render sldl configs via
  literal Python substitution instead of sed (closes a command-injection
  and path-traversal path through playlist names).
- shlex-quote credential values written to shell-sourced env files, and
  strip newlines from values patched into .conf files.
- Render playlist .conf files 0600; warn at startup if the master key is
  co-located with the config volume; document keeping it separate.

Portability:
- Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton.
- Remove personal defaults (navidrome user "andrew", ephemeral.club URLs).
- Ship generic example seeds; move the cross-album dedup keep-list and the
  legacy playlist import to editable config files; drop the personal
  _upgrade.csv.
- Generic VPN reference in docker-compose.snippet.yml.

First-run experience:
- Redirect to /setup instead of 500 when OIDC is unconfigured; surface a
  missing master key inline; entrypoint exits with an actionable message
  when the config folder is not writable.
- Add unauthenticated /health (JSON) and /setup (checklist) diagnostics.

Docs:
- Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced
  but missing); expand README with ownership, backups, advanced settings,
  and migration guidance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/services/scheduler_service.py

@@ -1,4 +1,6 @@
+import logging
 import time
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 from apscheduler.schedulers.asyncio import AsyncIOScheduler
 from apscheduler.triggers.cron import CronTrigger
@@ -9,7 +11,22 @@ from app.models import Playlist, ScheduledJob
 from app.services import dedup_review_service, genre_review_service, pipeline_runner
 from app.settings import settings
 
-TIMEZONE = "America/Edmonton"
+log = logging.getLogger("alembic")
+
+
+def _resolve_timezone(name: str) -> str:
+    """Validate the configured timezone, falling back to UTC if it isn't a
+    real IANA zone. Returned as a string because that's what APScheduler and
+    CronTrigger accept directly."""
+    try:
+        ZoneInfo(name)
+        return name
+    except (ZoneInfoNotFoundError, ValueError):
+        log.warning("Unknown timezone %r, falling back to UTC.", name)
+        return "UTC"
+
+
+TIMEZONE = _resolve_timezone(settings.timezone)
 
 # ---------------------------------------------------------------------------
 # Maintenance jobs, ported 1:1 from /etc/cron.d/sldl-maintenance. Each entry