Initial Mist scaffold

Successor to the Josh Steam prototypes. Single-VM Docker Compose stack with
the load-bearing core/ logic ported from JoshSteam CDN with bug fixes.

Contents:
- backend/  FastAPI + Celery (same image, two entrypoints)
            core/  hdiff, librsync, chain_replay, manifest, compression,
                   discord, steam, unrealpak, paths
            api/   auth, catalog, admin, builds (skeletons) + downloads (real)
            worker/  Celery factory replacing the missing prototype Tasks/__init__.py
            db/    SQLAlchemy models + Alembic initial migration
- admin-web/  SvelteKit + Tailwind skeleton
- client/    Tauri 2 + Svelte skeleton (Mist placeholder UI)
- mistpipe/  click-based admin CLI with subcommand stubs
- docs/      ARCHITECTURE, DECISIONS (9 ADRs), RUNBOOK
- docker-compose.yml + dev overlay + .github/workflows

Bugs fixed during port:
- Routes/download.py:2 stray backslash on import line
- Utils/celery.py inspect.reserved() missing parens + double active() typo
- Hardcoded OneDrive/Desktop paths replaced with pydantic-settings config
- Discord webhook URL + RabbitMQ password moved to env vars
- Missing Tasks/__init__.py reconstructed as worker/__init__.py

Out of scope for this commit: route bodies, UI screens, mistpipe subcommand
bodies, real image builds.

.github/workflows/admin-web.yml

@@ -0,0 +1,48 @@
+name: admin-web
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "admin-web/**"
+      - ".github/workflows/admin-web.yml"
+  pull_request:
+    paths:
+      - "admin-web/**"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - working-directory: admin-web
+        run: |
+          npm install --no-audit --no-fund
+          npm run check
+          npm run build
+
+  build-and-push:
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v6
+        with:
+          context: ./admin-web
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/mist-admin-web:latest
+            ghcr.io/${{ github.repository_owner }}/mist-admin-web:${{ github.sha }}

.github/workflows/backend.yml

@@ -0,0 +1,52 @@
+name: backend
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "backend/**"
+      - ".github/workflows/backend.yml"
+  pull_request:
+    paths:
+      - "backend/**"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install
+        working-directory: backend
+        run: pip install -e .[dev]
+      - name: Smoke tests
+        working-directory: backend
+        run: pytest -q
+      - name: Lint
+        working-directory: backend
+        run: ruff check src tests
+
+  build-and-push:
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v6
+        with:
+          context: ./backend
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/mist-backend:latest
+            ghcr.io/${{ github.repository_owner }}/mist-backend:${{ github.sha }}

.github/workflows/client.yml

@@ -0,0 +1,30 @@
+name: client
+
+on:
+  push:
+    tags: ["client-v*"]
+  workflow_dispatch:
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [windows-latest]   # add ubuntu-22.04 / macos-latest later
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install client deps
+        working-directory: client
+        run: npm install --no-audit --no-fund
+      - name: Build Tauri
+        working-directory: client
+        run: npx tauri build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: mist-client-${{ matrix.platform }}
+          path: client/src-tauri/target/release/bundle/**

.github/workflows/mistpipe.yml

@@ -0,0 +1,26 @@
+name: mistpipe
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "mistpipe/**"
+      - ".github/workflows/mistpipe.yml"
+  pull_request:
+    paths:
+      - "mistpipe/**"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install
+        working-directory: mistpipe
+        run: pip install -e .
+      - name: Import check
+        working-directory: mistpipe
+        run: python -c "from mistpipe.cli import cli; print('mistpipe CLI imports cleanly')"