feat: replace SFTP drop with Syncthing share path

Remove SFTPGo; mount event data from the Syncthing folder, watch
incoming/, and name variants after the source stem.

Co-authored-by: Cursor <cursoragent@cursor.com>

compose.yml

@@ -1,51 +1,18 @@
-# live.f12.rocks — event photo pipeline: SFTP inbox -> gmic/rembg -> web.
+# live.f12.rocks — event photo pipeline: Syncthing drop -> gmic/rembg -> web.
 #
-# All three services share one host directory (default ./data, see
-# .env.example DATA_HOST_DIR) at different mount points:
-#   sftpgo  -> /srv/sftpgo/data      (SFTP user home = /srv/sftpgo/data/inbox)
-#   worker  -> /data                 (watches /data/inbox, writes /data/jobs)
-#   web     -> /data                 (reads jobs, writes remix variants)
+# worker + web share one host directory (Syncthing share root):
+#   ${DATA_HOST_DIR:-/home/frank/sync.schwenk.online/data/livef12} -> /data
+#   worker watches /data/incoming, writes /data/jobs
+#   web reads jobs, writes remix variants
 #
-# Copy .env.example to .env and fill in real SFTP credentials before
-# running this. Never commit .env.
+# Syncthing itself runs on the host (not in this compose). Copy .env.example
+# to .env for local overrides (e.g. DATA_HOST_DIR=./data). Never commit .env.
 
 services:
-  sftpgo:
-    image: drakkan/sftpgo:v2
-    restart: unless-stopped
-    # The image defaults to a fixed uid 1000 user. worker/web run as root
-    # (see Dockerfile), and Docker itself creates first-run bind-mount
-    # directories (./data/inbox, ./data/jobs, ...) as root:root — running
-    # sftpgo as root too avoids a uid mismatch on the shared ./data tree.
-    user: root
-    entrypoint: ["/bin/sh", "/entrypoint.sh"]
-    environment:
-      SFTP_USER: ${SFTP_USER:-livef12}
-      SFTP_PASSWORD: ${SFTP_PASSWORD:-changeme}
-      # Minutes. Default SFTPGo is 15 — too aggressive for Android clients
-      # that idle after a successful upload (shows up as EOF in the logs).
-      SFTPGO_COMMON__IDLE_TIMEOUT: ${SFTPGO_IDLE_TIMEOUT:-120}
-    volumes:
-      - ${DATA_HOST_DIR:-./data}:/srv/sftpgo/data
-      - sftpgo_state:/var/lib/sftpgo
-      - ./sftpgo/entrypoint.sh:/entrypoint.sh:ro
-    ports:
-      # SFTP only. The SFTPGo web admin (container port 8080) is
-      # intentionally NOT published here and NOT attached to the
-      # `traefik` network — it stays unreachable from outside docker.
-      #
-      # Host SFTP port. Spec asked for 121212 which exceeds TCP max
-      # (65535); production default is 12121.
-      - "${SFTP_HOST_PORT:-12121}:2022"
-    networks:
-      - internal
-
   worker:
     build: .
     restart: unless-stopped
     command: ["python3", "-m", "app.worker"]
-    depends_on:
-      - sftpgo
     environment:
       DATA_DIR: /data
       OUTPUT_COUNT: ${OUTPUT_COUNT:-3}
@@ -60,7 +27,7 @@ services:
       REMBG_ALPHA: ${REMBG_ALPHA:-1}
       NICE_LEVEL: ${NICE_LEVEL:-18}
     volumes:
-      - ${DATA_HOST_DIR:-./data}:/data
+      - ${DATA_HOST_DIR:-/home/frank/sync.schwenk.online/data/livef12}:/data
       - ./assets:/data/assets:ro
       - rembg_cache:/app/.home
     # Sequential-only by design (no threads/async in worker.py); these
@@ -92,7 +59,7 @@ services:
       NICE_LEVEL: ${NICE_LEVEL:-18}
       SITE_TITLE: live.f12.rocks
     volumes:
-      - ${DATA_HOST_DIR:-./data}:/data
+      - ${DATA_HOST_DIR:-/home/frank/sync.schwenk.online/data/livef12}:/data
       - ./assets:/data/assets:ro
     labels:
       - "traefik.enable=true"
@@ -110,5 +77,4 @@ networks:
     external: true
 
 volumes:
-  sftpgo_state:
   rembg_cache: