Add widget API endpoints for backstage dashboard integration

New GET /api/widget/recent — returns recent unwatched videos from followed
channels (title, channel, thumbnail, published_at, duration, direct URL).
New GET /api/widget/stats — unwatched count, new this week, channel count.

Both endpoints auth via X-Widget-Key header (WIDGET_API_KEY env var) so
external services can call without JWT token lifecycle management.
Targets the first admin user's data.

Also: pass WIDGET_API_KEY through docker-compose environment.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/config.py

@@ -9,6 +9,7 @@ class Settings(BaseSettings):
     secret_key: str = "changeme-use-a-real-secret-in-production"
     algorithm: str = "HS256"
     access_token_expire_minutes: int = 60 * 24 * 7  # 1 week
+    widget_api_key: str = ""  # set WIDGET_API_KEY in env for backstage integration