Update invidious stack to use companion approach

- Replace inv_sig_helper with invidious-companion for better YouTube API handling
- Add healthcheck for main container
- Add resource limits for all containers
- Add SQL init scripts for fresh database setup
- Update README with invidious secrets documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

README.md

@@ -18,6 +18,7 @@ stacks/
 ├── perilous/         # Blog/website
 ├── ramz/             # Go web app
 ├── bookclub/         # Form mailer
+├── invidious/        # YouTube frontend
 ├── watchtower/       # Auto container updates
 ├── dockge/           # Container management UI
 └── smokeping/        # Network monitoring
@@ -96,6 +97,13 @@ Set these in Gitea → Repository → Settings → Actions → Secrets:
 |--------|-------------|
 | `PERILOUS_CODE_SERVER_PASSWORD` | Code-server password |
 
+### Invidious
+| Secret | Description |
+|--------|-------------|
+| `INVIDIOUS_DB_PASSWORD` | PostgreSQL password |
+| `INVIDIOUS_HMAC_KEY` | Generate: `openssl rand -hex 16` |
+| `INVIDIOUS_COMPANION_KEY` | Generate: `openssl rand -hex 16` (must match companion) |
+
 ## Runner Setup
 
 The workflow requires a self-hosted runner on the prod server: