feat: add Obsidian CLI API service

- Add Docker image for the official Obsidian desktop app and CLI.

- Start Obsidian headlessly with Xvfb and DBus setup.

- Expose a safe structured HTTP command API without shell execution.

- Add JWT-based vault, path, and command authorization.

- Support single-vault and multi-vault container mounts.

- Add TypeScript SDK helpers for Obsidian CLI commands.

- Add n8n community node package with Obsidian operations.

- Add docs, compose config, tests, and production image workflow.

scripts/entrypoint.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env sh
+set -eu
+
+mkdir -p "$XDG_RUNTIME_DIR" /root/.config /root/.config/obsidian /root/.cache /root/.local/share /run/dbus
+chmod 700 "$XDG_RUNTIME_DIR"
+
+# Electron apps are happier with a DBus session, even under Xvfb.
+if command -v dbus-launch >/dev/null 2>&1; then
+  eval "$(dbus-launch --sh-syntax)"
+  export DBUS_SESSION_BUS_ADDRESS DBUS_SESSION_BUS_PID
+fi
+
+# Enable the official Obsidian CLI and register mounted vaults in global desktop-app settings.
+# This is the same CLI setting toggled by Settings > General > Advanced > Command line interface.
+DEFAULT_VAULT_PATH="$(python /app/scripts/render_config.py | tail -n 1)"
+
+# Start a virtual X server for the official Obsidian desktop app.
+Xvfb "$DISPLAY" -screen 0 "${XVFB_SCREEN:-1280x1024x24}" -nolisten tcp >/tmp/xvfb.log 2>&1 &
+XVFB_PID=$!
+
+cleanup() {
+  if [ -n "${OBSIDIAN_PID:-}" ] && kill -0 "$OBSIDIAN_PID" 2>/dev/null; then
+    kill "$OBSIDIAN_PID" 2>/dev/null || true
+  fi
+  kill "$XVFB_PID" 2>/dev/null || true
+}
+trap cleanup INT TERM EXIT
+
+# Open the mounted vault using the official desktop app. The official CLI talks
+# to this running app through $XDG_RUNTIME_DIR/.obsidian-cli.sock.
+/opt/Obsidian/obsidian \
+  --no-sandbox \
+  --disable-gpu \
+  --disable-software-rasterizer \
+  --disable-dev-shm-usage \
+  --disable-features=UseOzonePlatform \
+  "${DEFAULT_VAULT_PATH}" \
+  >/tmp/obsidian.log 2>&1 &
+OBSIDIAN_PID=$!
+
+SOCKET="$XDG_RUNTIME_DIR/.obsidian-cli.sock"
+WAIT_SECONDS="${OBSIDIAN_STARTUP_TIMEOUT:-60}"
+STARTED=0
+while [ "$STARTED" -lt "$WAIT_SECONDS" ]; do
+  if [ -S "$SOCKET" ]; then
+    break
+  fi
+  STARTED=$((STARTED + 1))
+  sleep 1
+done
+
+if [ ! -S "$SOCKET" ]; then
+  echo "WARNING: Official Obsidian CLI socket was not created at $SOCKET after ${WAIT_SECONDS}s." >&2
+  echo "The HTTP API will still start, but /commands may fail until Obsidian exposes the CLI socket." >&2
+  echo "Obsidian log tail:" >&2
+  tail -80 /tmp/obsidian.log >&2 || true
+fi
+
+exec uv run python -m app.main