Initial Mist scaffold

Successor to the Josh Steam prototypes. Single-VM Docker Compose stack with
the load-bearing core/ logic ported from JoshSteam CDN with bug fixes.

Contents:
- backend/  FastAPI + Celery (same image, two entrypoints)
            core/  hdiff, librsync, chain_replay, manifest, compression,
                   discord, steam, unrealpak, paths
            api/   auth, catalog, admin, builds (skeletons) + downloads (real)
            worker/  Celery factory replacing the missing prototype Tasks/__init__.py
            db/    SQLAlchemy models + Alembic initial migration
- admin-web/  SvelteKit + Tailwind skeleton
- client/    Tauri 2 + Svelte skeleton (Mist placeholder UI)
- mistpipe/  click-based admin CLI with subcommand stubs
- docs/      ARCHITECTURE, DECISIONS (9 ADRs), RUNBOOK
- docker-compose.yml + dev overlay + .github/workflows

Bugs fixed during port:
- Routes/download.py:2 stray backslash on import line
- Utils/celery.py inspect.reserved() missing parens + double active() typo
- Hardcoded OneDrive/Desktop paths replaced with pydantic-settings config
- Discord webhook URL + RabbitMQ password moved to env vars
- Missing Tasks/__init__.py reconstructed as worker/__init__.py

Out of scope for this commit: route bodies, UI screens, mistpipe subcommand
bodies, real image builds.

backend/Dockerfile

@@ -0,0 +1,35 @@
+# Mist backend image — used by both `api` and `worker` containers.
+# The api container runs uvicorn (the default ENTRYPOINT); the worker container
+# overrides the command to `celery -A mist.worker worker --loglevel=INFO`.
+
+FROM python:3.12-slim AS base
+
+# System deps for py7zr, librsync, hdiff, build tools.
+# hdiffz/hpatchz/rdiff binaries are expected to be installed here at /usr/local/bin.
+# In dev they can be bind-mounted; in prod they're baked in. Placeholder COPY below.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential \
+        librsync-dev \
+        rdiff \
+        curl \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# TODO: copy hdiffz/hpatchz binaries from a known release tarball (build-time stage)
+#       For now, the operator is expected to provide them; or build from source.
+
+WORKDIR /app
+
+COPY pyproject.toml ./pyproject.toml
+COPY src ./src
+COPY alembic.ini ./alembic.ini
+
+RUN pip install --no-cache-dir -e .
+
+ENV PYTHONPATH=/app/src
+ENV PYTHONUNBUFFERED=1
+
+EXPOSE 8000
+
+# Default entrypoint = api. The worker container overrides this in docker-compose.yml.
+CMD ["uvicorn", "mist.api.app:app", "--host", "0.0.0.0", "--port", "8000"]