Add FastAPI app skeleton: settings, db, models, security, auth

- settings.py: pydantic-settings config for the two mount points
  (MUSIC_DATA_DIR, ALEMBIC_CONFIG_DIR), OIDC client config, encryption key path
- db.py: SQLite engine with WAL mode, plain-SQL schema migration runner
  (schema/*.sql, tracked by schema_version -- not the alembic migration tool)
- models.py: SQLAlchemy ORM models matching schema/0001_init.sql
- security/crypto.py: Fernet encrypt/decrypt for the secrets table
- security/oidc.py + routers/auth.py: Pocket ID OIDC login/callback/logout
- security/deps.py: require_auth dependency (redirect-to-login on no session)
- main.py: app factory, lifespan (init_db + beets WAL enable), session
  middleware, minimal dashboard route

Verified boots end-to-end via TestClient: unauthenticated GET / redirects to
/auth/login, static files serve, and all 13 schema tables get created on
first run.

app/templates/dashboard.html

@@ -0,0 +1,10 @@
+{% extends "base.html" %}
+{% block title %}Dashboard — alembic{% endblock %}
+{% block content %}
+<h1>Dashboard</h1>
+<p class="muted">
+  Logged in as {{ user.name or user.email }}. Playlist status, job history,
+  and pipeline health will render here once the corresponding services are
+  built (status_service, scheduler_service).
+</p>
+{% endblock %}