Initial commit: playlink music library hardlink deduplicator

Go backend (chi, SQLite) with an embedded React/TypeScript UI that finds
songs present in both a host and a slave music library and replaces the
slave copy with a hardlink to the host copy.

- Path-first matching with format/title/album-folder fallbacks
- Auto-linking of byte-identical files, re-verified with cmp before linking
- Manual review with ffprobe quality comparison, downgrade guard and
  promote-to-host override
- Build mode to populate an empty slave library from the host
- Dry run by default, atomic stage+rename replacement, quarantine with
  retention, undo, path confinement and authenticated UI
- Dockerfile and compose file for Unraid

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1
+
+FROM node:22-alpine AS web
+WORKDIR /src/web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/ ./
+RUN npm run build
+
+FROM golang:1.27-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+COPY --from=web /src/web/dist ./web/dist
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o /out/playlink ./cmd/playlink
+
+FROM alpine:3.22
+# ffprobe (from ffmpeg) powers the codec/quality comparison in manual review.
+RUN apk add --no-cache ffmpeg tzdata ca-certificates
+COPY --from=build /out/playlink /usr/local/bin/playlink
+ENV PLAYLINK_ADDR=:7480 \
+    PLAYLINK_DATA_DIR=/config \
+    PLAYLINK_ALLOWED_ROOTS=/data
+# Unraid's nobody:users. Override with `user:` in compose to match your file ownership.
+USER 99:100
+VOLUME /config
+EXPOSE 7480
+HEALTHCHECK --interval=30s --timeout=5s CMD wget -qO- http://127.0.0.1:7480/healthz || exit 1
+ENTRYPOINT ["/usr/local/bin/playlink"]