feat(metadata): SQLite backend, storage reconciliation and local defaults

- pluggable per-domain Repository interfaces; PostgreSQL and SQLite impls
- SQLite on modernc.org/sqlite (WAL, busy_timeout, foreign_keys, immediate tx)
- separate migrations/sqlite and db.MigrateSQLite; store.NewPostgres/NewSQLite
- cmd/reconcile compares object storage with the journal (report, then --delete)
- storage.Backend.List and photos.Repository.AllStorageKeys
- DB_BACKEND/SQLITE_PATH and STORAGE_BACKEND/FS_ROOT selectable; local defaults
  (sqlite ./galo.db, fs ./data)
- Makefile reconcile/reconcile-delete; docs and .env.example updated

backend/internal/config/config.go

@@ -59,10 +59,16 @@ type Storage struct {
 	URLTTL    time.Duration
 }
 
+type Database struct {
+	Backend    string
+	SQLitePath string
+}
+
 type Config struct {
 	Postgres Postgres
 	S3       S3
 	Storage  Storage
+	Database Database
 	Auth     Auth
 	Server   Server
 	SSE      SSE
@@ -138,11 +144,15 @@ func Load() (*Config, error) {
 			UsePathStyle: pathStyle,
 		},
 		Storage: Storage{
-			Backend:   getEnv("STORAGE_BACKEND", "s3"),
-			FSRoot:    getEnv("FS_ROOT", ""),
+			Backend:   getEnv("STORAGE_BACKEND", "fs"),
+			FSRoot:    getEnv("FS_ROOT", "./data"),
 			URLSecret: getEnv("URL_SECRET", ""),
 			URLTTL:    urlTTL,
 		},
+		Database: Database{
+			Backend:    getEnv("DB_BACKEND", "sqlite"),
+			SQLitePath: getEnv("SQLITE_PATH", "./galo.db"),
+		},
 		Auth: Auth{
 			JWTSecret:  getEnv("JWT_SECRET", ""),
 			AccessTTL:  accessTTL,
@@ -166,8 +176,18 @@ func Load() (*Config, error) {
 	if cfg.Auth.JWTSecret == "" {
 		return nil, fmt.Errorf("JWT_SECRET is required")
 	}
-	if cfg.Postgres.Password == "" {
-		return nil, fmt.Errorf("PG_PASSWORD is required")
+
+	switch cfg.Database.Backend {
+	case "postgres":
+		if cfg.Postgres.Password == "" {
+			return nil, fmt.Errorf("PG_PASSWORD is required")
+		}
+	case "sqlite":
+		if cfg.Database.SQLitePath == "" {
+			return nil, fmt.Errorf("SQLITE_PATH is required when DB_BACKEND=sqlite")
+		}
+	default:
+		return nil, fmt.Errorf("invalid DB_BACKEND %q (want postgres or sqlite)", cfg.Database.Backend)
 	}
 
 	switch cfg.Storage.Backend {