Add FastAPI app skeleton: settings, db, models, security, auth

- settings.py: pydantic-settings config for the two mount points
  (MUSIC_DATA_DIR, ALEMBIC_CONFIG_DIR), OIDC client config, encryption key path
- db.py: SQLite engine with WAL mode, plain-SQL schema migration runner
  (schema/*.sql, tracked by schema_version -- not the alembic migration tool)
- models.py: SQLAlchemy ORM models matching schema/0001_init.sql
- security/crypto.py: Fernet encrypt/decrypt for the secrets table
- security/oidc.py + routers/auth.py: Pocket ID OIDC login/callback/logout
- security/deps.py: require_auth dependency (redirect-to-login on no session)
- main.py: app factory, lifespan (init_db + beets WAL enable), session
  middleware, minimal dashboard route

Verified boots end-to-end via TestClient: unauthenticated GET / redirects to
/auth/login, static files serve, and all 13 schema tables get created on
first run.

app/main.py

@@ -0,0 +1,34 @@
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI
+from fastapi.staticfiles import StaticFiles
+from starlette.middleware.sessions import SessionMiddleware
+
+from app.db import enable_beets_db_wal, init_db
+from app.routers import auth, dashboard
+from app.settings import settings
+
+
+@asynccontextmanager
+async def lifespan(_app: FastAPI):
+    init_db()
+    enable_beets_db_wal()
+    # Task 5 (scheduler_service) hooks APScheduler start/stop in here once
+    # the job registry and pipeline_runner exist.
+    yield
+
+
+def create_app() -> FastAPI:
+    app = FastAPI(title="alembic", lifespan=lifespan)
+
+    app.add_middleware(SessionMiddleware, secret_key=settings.session_secret)
+
+    app.mount("/static", StaticFiles(directory="app/static"), name="static")
+
+    app.include_router(auth.router)
+    app.include_router(dashboard.router)
+
+    return app
+
+
+app = create_app()