deploy: give mavsttd the render group so whisper hits the GPU

Mapping /dev/dri alone wasn't enough — the container runs as unprivileged
uid 10001, and renderD128 is root:render (mode crw-rw----). Without membership
in the host render gid, Vulkan enumerates zero devices and whisper silently
falls back to CPU. Added group_add 993 (host 'render'); whisper now loads on
RADV RENOIR (AMD Radeon).

docker-compose.yml

@@ -32,9 +32,13 @@ services:
     <<: *image
     command: ["mavsttd", "-socket", "/run/maven/stt.sock", "-model", "/opt/maven/models/stt/ggml-small.bin"]
     depends_on: [mavend]
-    # whisper uses libggml-vulkan → needs the GPU render node.
+    # whisper uses libggml-vulkan (RADV on the host's AMD GPU) → needs the
+    # render node AND membership in the group that owns it, or Vulkan enumerates
+    # zero devices and falls back to CPU.
     devices:
       - "/dev/dri:/dev/dri"
+    group_add:
+      - "993"   # host 'render' gid owning /dev/dri/renderD128 (getent group render)
     volumes:
       - sockets:/run/maven
       - ./models:/opt/maven/models:ro