Prep for single-host deploy: S3-compatible image store, droplet stack, ffmpeg gating

[windoze95]

Why

The AWS bill is ~$60/mo and ~$45 of it is plumbing for a workload that averages 0.1% of a quarter-vCPU: five public IPv4s ($18.61), an ALB in front of one Fargate task ($16.74), and a t4g.micro RDS ($14.68). The whole thing fits on one $18 DigitalOcean droplet. This PR is the backward-compatible prep — nothing changes on the current ECS deployment (every new setting defaults to today's AWS path), so it can merge and deploy before the cutover.

Full plan + runbook: deploy/README.md.

What

Image storage → any S3-compatible bucket (internal/s3, internal/config)

• S3_ENDPOINT (R2/Spaces/MinIO; empty = AWS S3), S3_REGION, S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY (fall back to AWS_*, which SES keeps using), S3_PUBLIC_URL — stored image URLs are built from it, so the DB stops referencing the storage host.
• S3KeyFromURL/RecipeImageKeyFromURL take the config and understand both the public host and the legacy amazonaws.com shapes (old rows) — the amazonaws branch goes away in the cleanup PR after cutover.
• S3 client built once per process (was per call → credential re-resolution on every upload).
• R2 needs the SDK's CRC checksum trailers off; done only when an endpoint is set.
• MCP widget CSP resourceDomains gets the public image origin.

Deploy stack (deploy/) — compose (Caddy + api + pgvector/pgvector:pg16), Caddyfile (Cloudflare Origin CA cert, CF edge ranges as trusted proxies for real client IPs, SSE flushing, 32 MB bodies), host-setup.sh / deploy.sh / backup.sh (6-hourly pg_dump → R2, ntfy on failure), .env.example, and the rehearsal/cutover/teardown runbook.

CI (deploy.yml) — image always pushed to GHCR; repository variable DEPLOY_TARGET selects ecs (default, unchanged flow) or droplet (scp stack files → deploy.sh <sha> → verify running digest + public /ping).

Video import burst-proofing (internal/video) — ffmpeg is the only CPU-bound work in the API. It now runs nice -n 19 with -threads 1, and a sampler-wide slot serializes download+ffmpeg so simultaneous imports can't starve the API/Postgres on a shared host. Only the seconds of local work are gated — no slot is held during model calls. FrameSampler interface untouched.

Also — dev compose uses pgvector/pgvector:pg17 (plain postgres:17.2 can't CREATE EXTENSION vector), .dockerignore (the 40 MB api binary and .git were in the build context), docs, vestigial configs/config.json removed, go mod tidy (relabels only).

Verification

• go vet ./... && go test ./... -count=1 green (offline); new tests: public-URL key round-trip incl. escaped segments, legacy URL fallback, CSP domains, ffmpeg argv, and a race-checked test proving a second video job waits for the first's ffmpeg (and gives up on ctx cancel).
• caddy validate passes on the Caddyfile (with a throwaway cert); docker compose config passes.
• Image builds with the new .dockerignore; nice + ffmpeg confirmed inside it.
• Behaviour on ECS: with no S3_* vars set, newS3Client receives the same region/creds as before and UploadRecipeImageToS3 still returns result.Location.