chore: docker, config, delivery sinks, dialogue, and agent docs

- Dockerfile: multi-stage build with CGO_ENABLED=0, embedder model copy,
  non-root user, healthcheck, and /data volume.
- docker-compose.yml: mavend + mavweb services with shared volume, health
  checks, and restart policy.
- .gitignore: ignore models/llm/*.gguf, deploy/telegram.env, tmp artifacts.
- deploy/mavend.json: add LLM, phraser, voice sections (embedder, model
  paths, wake sensitivity). Add telegram token env-var expansion.
- deploy/telegram.env.example: template for telegram bot token.
- internal/config/config.go: add LLM config struct, voice config struct
  (embedder, llama, wake sensitivity), telegram token loading.
- telegramsink: add chat intent delivery support alongside existing types.
- voicesink: skip empty payloads in delivery.
- dialogue/session: add chat intent to anaphora resolution, test coverage.
- AGENTS.md: update with LLM embedder, LFM model download/configure steps,
  new UI conventions.
- REARCH.md: architecture research document.
- cmd/mavend/main.go: wire LLM config, phraser, embedder, telegram config,
  WebAuthn, IPC event/routine handlers, and reactive notes.

Dockerfile

@@ -46,6 +46,30 @@ RUN go build -o /out/mavend    ./cmd/mavend    && \
     go build -o /out/mavpoll   ./cmd/mavpoll   && \
     go build -o /out/mavcaldav ./cmd/mavcaldav
 
+# llama.cpp Vulkan build — the phraser/router LFM engine (llama-server). Built
+# from source (not a prebuilt vendored blob) so the binary's glibc/GLIBCXX match
+# the trixie runtime and GPU offload rides mesa's RADV Vulkan driver — the same
+# path whisper already uses on homesrv's AMD iGPU (RADV RENOIR). Pinned to b9601 (parity with
+# the host's known-good build). Static (BUILD_SHARED_LIBS=OFF) ⇒ one self-
+# contained binary, no libggml/libllama .so to juggle in the runtime; only
+# libvulkan.so.1 + libgomp (both already in the runtime) are needed at load.
+FROM debian:trixie-slim AS llama
+ARG LLAMA_REF=b9601
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates git cmake build-essential libvulkan-dev \
+      glslc glslang-tools spirv-headers spirv-tools \
+    && rm -rf /var/lib/apt/lists/*
+RUN git clone --depth 1 --branch ${LLAMA_REF} \
+      https://github.com/ggml-org/llama.cpp /src/llama.cpp
+WORKDIR /src/llama.cpp
+RUN cmake -B build \
+      -DCMAKE_BUILD_TYPE=Release \
+      -DGGML_VULKAN=ON \
+      -DBUILD_SHARED_LIBS=OFF \
+      -DLLAMA_CURL=OFF \
+      -DLLAMA_BUILD_SERVER=ON \
+    && cmake --build build --config Release -j"$(nproc)" --target llama-server
+
 FROM debian:trixie-slim AS runtime
 # tzdata so the TZ env (set in compose) resolves — otherwise Go can't load the
 # zone and time.Now() stays UTC, and mavend answers clock/date queries and
@@ -71,6 +95,9 @@ RUN cd /opt/maven/lib \
     && ln -sf libonnxruntime.so.1.26.0 libonnxruntime.so \
     && ln -sf libonnxruntime.so.1.26.0 libonnxruntime.so.1
 COPY --from=build /out/ /opt/maven/bin/
+# the LFM engine: static Vulkan llama-server on PATH; the phraser spawns it by
+# name (bin_path "llama-server"). GPU offload needs /dev/dri passed to mavend.
+COPY --from=llama /src/llama.cpp/build/bin/llama-server /opt/maven/bin/
 
 ENV LD_LIBRARY_PATH=/opt/maven/lib PATH=/opt/maven/bin:$PATH