feat: organizer Android app and token-gated upload API

Replace Syncthing as the product upload path with a share-target app
and POST /api/jobs. Web UI live-polls job progress.

Co-authored-by: Cursor <cursoragent@cursor.com>

compose.yml

@@ -1,12 +1,12 @@
-# live.f12.rocks — event photo pipeline: Syncthing drop -> gmic/rembg -> web.
+# live.f12.rocks — event photo pipeline: Android upload -> gmic/rembg -> web.
 #
-# worker + web share one host directory (Syncthing share root):
+# worker + web share one host directory:
 #   ${DATA_HOST_DIR:-/home/frank/sync.schwenk.online/data/livef12} -> /data
 #   worker watches /data/incoming, writes /data/variants + /data/intermediates
-#   web reads meta/ + image dirs, writes remix variants
+#   web serves HTML + /api (POST /api/jobs needs UPLOAD_TOKEN)
 #
-# Syncthing itself runs on the host (not in this compose). Copy .env.example
-# to .env for local overrides (e.g. DATA_HOST_DIR=./data). Never commit .env.
+# Copy .env.example to .env for local overrides (DATA_HOST_DIR=./data,
+# UPLOAD_TOKEN=...). Never commit .env.
 
 x-app-env: &app-env
   DATA_DIR: /data
@@ -53,6 +53,7 @@ services:
     environment:
       <<: *app-env
       SITE_TITLE: live.f12.rocks
+      UPLOAD_TOKEN: ${UPLOAD_TOKEN:-}
     volumes:
       - ${DATA_HOST_DIR:-/home/frank/sync.schwenk.online/data/livef12}:/data
       - ./assets:/data/assets:ro