Add Windows PowerShell dev workflow

TODO.md

@@ -8,6 +8,11 @@
   - how it was verified
   - what is still risky or incomplete
 - If a push fails or a change remains local-only, that must be written here explicitly.
+- Active planning and handoff notes should be written in Korean.
+- After each meaningful completed task:
+  - update this file in context
+  - push the latest git state when operationally possible
+- Local git credentials used for push automation must stay in an ignored local-only file and must never be committed.
 
 ## Current State At A Glance
 - Project: `ai-media-hub`
@@ -35,6 +40,7 @@
 - Search preview delivery is now moving away from persistent on-disk preview caching toward live proxy / live transcode behavior, with Google Video preview reuse added to result cards and modal playback.
 - Search breadth and Gemini review budget were widened again because the latest user feedback still reported a thin visible result count even after smarter filtering.
 - The codebase is now back on the broader-search / modal-fitting direction associated with `5ca7aef`, with an added Gemini deadline guard to reduce reverse-proxy `504` risk.
+- Windows 11 local development now has a repo-local PowerShell bootstrap / run / self-test / push workflow built around `.venv`, `.tools`, and `.local` so the machine does not need global Go / ffmpeg / yt-dlp changes for this repo.
 
 ## Current Architecture
 - `backend/main.go`
@@ -217,6 +223,7 @@
 - [x] Local self-test workflow
 - [x] Source-specific search collectors
 - [x] Shared ranker service layer
+- [x] Windows 11 PowerShell local bootstrap / self-test / push workflow
 
 ## Important Current Constraints / Known Problems
 - Search backend quality is still the most fragile subsystem.
@@ -426,6 +433,24 @@
 - `node` is still not installed on this machine.
 - This is acceptable for the current repo because there is still no Node-based frontend build or lint workflow in-tree.
 - If future frontend work adds a Node toolchain, document the exact version and setup steps here before pushing.
+- Windows 11 repo-local workflow:
+  - `scripts/setup-dev.ps1`
+    - creates `.venv`
+    - installs `worker/requirements.txt` into the repo-local venv
+    - downloads repo-local Go into `.tools/go`
+    - downloads repo-local ffmpeg into `.tools/ffmpeg`
+    - creates local command shims under `.tools/bin` such as `python3.cmd`
+  - `scripts/enter-dev-shell.ps1`
+    - prepends `.venv`, `.tools/bin`, local Go, and local ffmpeg to `PATH`
+    - pins `GOPATH`, `GOMODCACHE`, and `GOCACHE` into `.local` so Go does not need user-profile write access
+  - `scripts/run-dev.ps1`
+    - launches the backend with Windows-friendly local environment wiring
+  - `scripts/selftest.ps1`
+    - PowerShell-native replacement for the Linux shell smoke test
+    - verifies `gofmt`, Python syntax, `go test ./...`, frontend syntax via `node --check`, backend build, mock SearXNG boot, `/healthz`, `/api/search`, and `/api/upload`
+  - `scripts/push.ps1`
+    - reads ignored local credentials from `.local/git-credentials.psd1`
+    - pushes without storing credentials in tracked files
 
 ## Local Self-Test Workflow
 - Primary command:
@@ -630,6 +655,33 @@
 - If behavior in the browser does not match the latest backend/frontend code, the first assumption should be stale frontend assets until proven otherwise
 
 ## Recent Change Log
+- Date: `2026-03-17`
+- What changed:
+  - Added repo-local Windows 11 PowerShell workflows:
+    - `scripts/dev-tools.ps1`
+    - `scripts/setup-dev.ps1`
+    - `scripts/enter-dev-shell.ps1`
+    - `scripts/run-dev.ps1`
+    - `scripts/selftest.ps1`
+    - `scripts/push.ps1`
+  - Added ignored local directories for `.venv`, `.tools`, and `.local`.
+  - Created a local-only git credential file for automated push flow and kept it excluded from git.
+  - Pinned PowerShell tooling to repo-local Go caches under `.local` so `go test` no longer depends on writable user-profile Go paths.
+- Why it changed:
+  - The active development machine is now Windows 11, and the user requested that setup, verification, and push flows work through PowerShell while minimizing machine-wide side effects.
+  - The previous local workflow was Linux-shell-oriented and did not directly cover Windows PowerShell usage.
+  - Initial Windows self-test attempts failed because Go wanted to write into the default user Go cache path, which was not reliably writable in this environment.
+- How it was verified:
+  - `pwsh -NoProfile -File scripts/setup-dev.ps1 -SkipPythonDeps -SkipGoDownload -SkipFFmpegDownload`
+  - elevated `pwsh -NoProfile -File scripts/setup-dev.ps1`
+  - `pwsh -NoProfile -Command ". .\scripts\enter-dev-shell.ps1; python3 --version; yt-dlp --version; go version; ffmpeg -version | Select-Object -First 1"`
+  - `pwsh -NoProfile -File scripts/selftest.ps1`
+  - `git check-ignore -v .local\git-credentials.psd1 .venv .tools`
+- What is still risky or incomplete:
+  - `scripts/setup-dev.ps1` still requires network access for Python package install and local Go / ffmpeg downloads on a truly fresh machine.
+  - The backend runtime still invokes `python3` by name, so Windows usage depends on entering the repo-local dev shell or otherwise exposing the generated shim on `PATH`.
+  - Push automation now uses an ignored local credential file, but credential rotation remains a manual step.
+
 - Date: `2026-03-17`
 - What changed:
   - Restored hard/ignorable Gemini batch error filtering so low-value thumbnail skips and no-visual candidate skips do not count as user-facing partial batch failures when useful recommendations were still recovered.