feat: rewrite backend in Rust (axum)

Replace the Node/Express backend with a Rust implementation that keeps
the same REST API, MongoDB collections and Redis cache keys, so existing
users, subscriptions and progress keep working.

- axum + mongodb + redis, bcrypt and HS256 JWT compatible with old data
- RSS parsing, iTunes discovery/trending, background sync (1h / 4h)
- Docker image now builds a static Rust binary on debian-slim
- CI runs cargo tests before publishing the image
- compose uses pull_policy: always so a restart picks up the new image

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -2,14 +2,37 @@ name: Build & Publish Docker Image
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'rust-*']
+  pull_request:
 
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: backend
+
+      - name: Run tests
+        run: cargo test
+
   build-and-push:
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: read