Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

infra/occupymedia/.env.example

@@ -0,0 +1,27 @@
+# occupymedia.cc deployment secrets — copy to .env on the box, fill every :? value.
+# NEVER commit the filled .env.
+
+# --- Cloudflare (already provisioned; tunnel + DNS + R2 buckets exist) ---
+CLOUDFLARE_ACCOUNT_ID=e50adafec3c6aee02a328f28b967f699
+CLOUDFLARE_TUNNEL_TOKEN=<fromkeepass-or-ask-coordinator>   # occupymedia tunnel e5695d8b-…
+
+# --- R2 (S3 API token: dashboard → R2 → Manage API Tokens → Object Read & Write,
+#     scoped to the four occupymedia-* buckets) ---
+R2_ACCESS_KEY=<paste R2 Access Key ID>
+R2_SECRET_KEY=<paste R2 Secret Access Key>
+
+# --- Database ---
+POSTGRES_PASSWORD=<generate: openssl rand -hex 24>
+# Runtime-only role provisioned by migration 003. Set its production password
+# with owner access; never reuse POSTGRES_PASSWORD or the development default.
+DATABASE_URL=postgres://sp_app:<runtime-password>@postgres:5432/occupymedia
+SCHEDULER_DATABASE_URL=postgres://sp_app:<runtime-password>@postgres:5432/occupymedia
+# SUPER_DATABASE_URL is passed only to the offline migration CLI, never services.
+PEERTUBE_DB_PASSWORD=<generate: openssl rand -hex 24>   # also paste into peertube.env
+SESSION_SECRET=<generate: openssl rand -base64 32>
+
+# --- Client-side envelope encryption for the media archive ---
+# One random 32-byte base64 key. It wraps EVERY stored blob (DEK/KEK envelope).
+# Lose it = archive unreadable. Rotate = full re-encrypt. Store in the password manager.
+S3_KEK=<generate ONCE: openssl rand -base64 32>
+SUPERPOSTER_KEK=<same bytes as S3_KEK, base64>