Initial TopDeck: self-hosted ranked favorites

A single Go binary with SQLite that serves a public page of the owner's
ranked lists (movies, TV, albums, songs, video games, theater) and a
login-gated editor.

- Lists of 1–65,535 entries (100 recommended), several per category
- Search-to-add via TMDB, TheTVDB, IGDB, Deezer/MusicBrainz, Wikipedia;
  manual entry as a fallback
- Theater entries carry a production (Broadway, tour, …), venue and cast
- Artwork cached locally; URL override and uploads
- Drag, arrow and type-a-rank reordering; paginated for long lists
- 12 theme presets plus custom CSS
- First-run setup code or env-provided admin; bcrypt, rate-limited login,
  CSRF-guarded JSON API
- Dockerfile and docker-compose.yml

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,21 @@
+# Copy to .env and fill in what you need. Everything here is optional.
+
+# Create the owner account on first start. If unset, TopDeck prints a one-time
+# setup code to the log and you create the account at http://<host>:4242/setup.
+TOPDECK_ADMIN_USERNAME=
+TOPDECK_ADMIN_PASSWORD=
+
+# API keys. You can also enter these in Settings → Integrations; values set
+# here take precedence and are locked in the web UI.
+TOPDECK_TMDB_API_KEY=
+TOPDECK_TVDB_API_KEY=
+TOPDECK_TVDB_PIN=
+TOPDECK_IGDB_CLIENT_ID=
+TOPDECK_IGDB_CLIENT_SECRET=
+
+# Behind a reverse proxy that terminates HTTPS:
+# TOPDECK_TRUST_PROXY=true     # honor X-Forwarded-For / -Proto / -Host
+# TOPDECK_SECURE_COOKIES=true  # always mark the session cookie Secure
+
+# TOPDECK_PORT=4242
+# TOPDECK_LOG_LEVEL=debug