Initial commit: MKV → AVI web app (Docker + Keycloak OIDC)

- App FastAPI : recherche dans un dossier média, download original ou
  conversion en AVI Xvid (tone-mapping HDR→SDR, audio FR auto, MP3 stéréo)
- Auth Keycloak OIDC (Authlib) optionnelle
- 3 composes : app seule, stack local (keycloak.local), production (NPM)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -0,0 +1,90 @@
+# Variante PRODUCTION : PostgreSQL + Keycloak (mode production) + app,
+# derrière Nginx Proxy Manager (TLS terminé par NPM).
+#
+#   cp .env.prod.example .env.prod   # puis renseigner les secrets
+#   docker compose --env-file .env.prod -f docker-compose.prod.yml up -d --build
+#
+# NPM (2 Proxy Hosts, forward en http vers l'IP de l'hôte) :
+#   auth.mkv2avi.maisongrondin.fr  ->  http://<IP_HOTE>:8080
+#   mkv2avi.maisongrondin.fr       ->  http://<IP_HOTE>:8090
+# → SSL Let's Encrypt + Force SSL + Websockets Support activés sur les deux.
+
+name: mkv2avi
+
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: mkv2avi-db
+    environment:
+      POSTGRES_DB: keycloak
+      POSTGRES_USER: keycloak
+      POSTGRES_PASSWORD: ${KC_DB_PASSWORD:?KC_DB_PASSWORD manquant}
+    volumes:
+      - kc-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    restart: unless-stopped
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.0
+    container_name: mkv2avi-keycloak
+    command: ["start", "--import-realm"]
+    environment:
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://db:5432/keycloak
+      KC_DB_USERNAME: keycloak
+      KC_DB_PASSWORD: ${KC_DB_PASSWORD:?KC_DB_PASSWORD manquant}
+      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_ADMIN:-admin}
+      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD:?KC_ADMIN_PASSWORD manquant}
+      # URL publique (issuer) — NPM termine le TLS, Keycloak sert en HTTP en interne
+      KC_HOSTNAME: https://auth.mkv2avi.maisongrondin.fr
+      KC_HTTP_ENABLED: "true"
+      KC_PROXY_HEADERS: xforwarded
+      KC_HEALTH_ENABLED: "true"
+    volumes:
+      - ./keycloak/realm-mkv2avi.json:/opt/keycloak/data/import/realm-mkv2avi.json:ro
+    ports:
+      - "${KC_HTTP_PORT:-8080}:8080"
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '200 OK'"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 60s
+    restart: unless-stopped
+
+  mkv2avi:
+    build: .
+    image: mkv2avi:latest
+    container_name: mkv2avi
+    environment:
+      - MAX_WORKERS=${MAX_WORKERS:-1}
+      - OIDC_ISSUER=https://auth.mkv2avi.maisongrondin.fr/realms/mkv2avi
+      - OIDC_CLIENT_ID=mkv2avi
+      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:?OIDC_CLIENT_SECRET manquant}
+      - OIDC_REDIRECT_URI=https://mkv2avi.maisongrondin.fr/auth/callback
+      - OIDC_POST_LOGOUT_REDIRECT_URI=https://mkv2avi.maisongrondin.fr/
+      - SESSION_SECRET=${SESSION_SECRET:?SESSION_SECRET manquant}
+      - SESSION_HTTPS_ONLY=true
+    volumes:
+      - ${MEDIA_DIR:?MEDIA_DIR manquant}:/media:ro
+      - ${OUTPUT_DIR:-./output}:/output
+    ports:
+      - "${APP_HTTP_PORT:-8090}:8000"
+    depends_on:
+      keycloak:
+        condition: service_healthy
+    # Repli si le conteneur ne résout pas le domaine public (hairpin NAT) :
+    # décommente en remplaçant par l'IP de NPM/hôte.
+    # extra_hosts:
+    #   - "auth.mkv2avi.maisongrondin.fr:192.168.1.200"
+    restart: unless-stopped
+
+volumes:
+  kc-db: