feat(metadata): SQLite backend, storage reconciliation and local defaults

- pluggable per-domain Repository interfaces; PostgreSQL and SQLite impls
- SQLite on modernc.org/sqlite (WAL, busy_timeout, foreign_keys, immediate tx)
- separate migrations/sqlite and db.MigrateSQLite; store.NewPostgres/NewSQLite
- cmd/reconcile compares object storage with the journal (report, then --delete)
- storage.Backend.List and photos.Repository.AllStorageKeys
- DB_BACKEND/SQLITE_PATH and STORAGE_BACKEND/FS_ROOT selectable; local defaults
  (sqlite ./galo.db, fs ./data)
- Makefile reconcile/reconcile-delete; docs and .env.example updated

.env.example

@@ -6,6 +6,11 @@ PG_PASSWORD=change_me
 PG_DATABASE=shared_album
 PG_SSLMODE=disable
 
+# Metadata backend: sqlite (default, embedded single instance) or postgres
+DB_BACKEND=sqlite
+# Path to the SQLite database file (used when DB_BACKEND=sqlite)
+SQLITE_PATH=./galo.db
+
 # S3 (Garage on s3.localnet) - internal storage, never exposed to clients
 S3_ENDPOINT=http://s3.localnet:3900
 S3_REGION=garage
@@ -14,11 +19,11 @@ S3_SECRET_KEY=change_me
 S3_BUCKET=galo-data
 S3_USE_PATH_STYLE=true
 
-# Storage backend: s3 (default, S3-compatible/Garage) or fs (local filesystem).
+# Storage backend: fs (default, local filesystem) or s3 (S3-compatible/Garage).
 # Blobs are always delivered through the backend via /api/objects/<key>.
-STORAGE_BACKEND=s3
-# Required when STORAGE_BACKEND=fs: root directory for object blobs
-FS_ROOT=/var/lib/galo/objects
+STORAGE_BACKEND=fs
+# Root directory for object blobs (STORAGE_BACKEND=fs)
+FS_ROOT=./data
 # Signs object URLs; falls back to JWT_SECRET when empty
 URL_SECRET=
 # Lifetime of signed object URLs