deploy: dockerize — one image, one container per daemon

Compose stack replacing start-maven.sh's bare `&`-backgrounded processes.
Single multi-stage image builds all six daemons (CGO + prebuilt native libs
from deps/); compose runs one container each with a different command. Only
mavend mounts the encryption key (env_file, gitignored) and the db volume; the
modules mount just the shared unix-socket dir and read-only models — so the
"key-free modules" boundary is OS-enforced (separate namespaces), not just a
code convention. IPC stays unix-domain over a shared volume: zero code change,
paths move to /run/maven. Encrypted db at rest on a named volume, decrypted
working copy in tmpfs (RAM) per the at-rest encryption landed earlier.

Validated: `docker compose config` clean, mavend.json parses, all daemon flags
confirmed. NOT build-tested (no docker/GPU in authoring env) — deploy/README.md
lists the host-dependent tweak points (GPU passthrough, onnxruntime path,
cross-container voice bind, netdata host).

Chosen Docker over interim systemd units per the "dockerize soon" call — no
throwaway supervisor built.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,28 @@
+# keep the build context small — the repo carries a full Go toolchain, the
+# whisper.cpp source tree, and ~1GB of models that must NOT ship in the image.
+.git
+models
+*.db
+certs
+
+# built binaries (rebuilt inside the image)
+/mavend
+/mavsttd
+/mavttsd
+/mavweb
+/mavpoll
+/mavcaldav
+/mavenclient
+
+# heavy deps we don't need in context. We keep only the prebuilt runtime libs
+# (deps/lib, deps/piper) and the headers the CGO build needs.
+deps/go
+deps/onnxruntime-linux-x64-*
+deps/whisper.cpp/**
+!deps/whisper.cpp
+!deps/whisper.cpp/ggml
+!deps/whisper.cpp/ggml/include
+!deps/whisper.cpp/ggml/include/**
+
+# local secrets — never bake into an image layer
+deploy/db_key.env