Add widget API endpoints for backstage dashboard integration

New GET /api/widget/recent — returns recent unwatched videos from followed
channels (title, channel, thumbnail, published_at, duration, direct URL).
New GET /api/widget/stats — unwatched count, new this week, channel count.

Both endpoints auth via X-Widget-Key header (WIDGET_API_KEY env var) so
external services can call without JWT token lifecycle management.
Targets the first admin user's data.

Also: pass WIDGET_API_KEY through docker-compose environment.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -11,6 +11,7 @@ services:
       DATABASE_URL: sqlite:////data/app.db
       DOWNLOAD_PATH: /downloads
       SECRET_KEY: ${SECRET_KEY:-changeme}
+      WIDGET_API_KEY: ${WIDGET_API_KEY:-}
   frontend:
     build:
       context: ./frontend