deploy: wire voice in the container — bind + real onnxruntime 1.26

"voice unavailable" in the web UI: mavweb dials mavend:9100, but the container
mavend.json had no voice block, so mavend never bound 9100 (worked pre-docker
because the host's ~/.config/maven/mavend.json had one). Ported that block:
enabled, bind 0.0.0.0:9100 (not 127.0.0.1 — mavweb is a separate container),
lang ru, stt/tts worker sockets, onnx embedder.

Enabling the embedder surfaced a second bug: the router needs onnxruntime 1.26,
but deps/lib only carries dangling symlinks to it (absolute host paths, not in
the image), so the only libonnxruntime present was piper's 1.14 (copied in) →
"ORT API base: 2", crash loop. Fixed the Dockerfile to ship the real 1.26 .so
and stop copying piper's .so into the shared lib dir (piper finds its own 1.14
via $ORIGIN + exact soname, so TTS is unaffected).

Verified: mavend "onnx embedder loaded (384 dim)", "voice listening on :9100",
stack stable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/mavend.json

@@ -3,5 +3,18 @@
   "db_tmpfs": "/dev/shm/maven-plain.db",
   "db_key_env": "MAVEN_DB_KEY",
   "socket_path": "/run/maven/mavend.sock",
-  "state_dir": "/var/lib/maven"
+  "state_dir": "/var/lib/maven",
+
+  "voice": {
+    "enabled": true,
+    "bind": "0.0.0.0:9100",
+    "lang": "ru",
+    "stt": { "socket": "/run/maven/stt.sock", "lang": "ru" },
+    "tts": { "socket": "/run/maven/tts.sock", "lang": "ru" },
+    "embedder": {
+      "model_path": "/opt/maven/models/embedder/model.onnx",
+      "tokenizer_path": "/opt/maven/models/embedder/tokenizer.json",
+      "lib_path": "/opt/maven/lib/libonnxruntime.so"
+    }
+  }
 }