chore: docker, config, delivery sinks, dialogue, and agent docs

- Dockerfile: multi-stage build with CGO_ENABLED=0, embedder model copy,
  non-root user, healthcheck, and /data volume.
- docker-compose.yml: mavend + mavweb services with shared volume, health
  checks, and restart policy.
- .gitignore: ignore models/llm/*.gguf, deploy/telegram.env, tmp artifacts.
- deploy/mavend.json: add LLM, phraser, voice sections (embedder, model
  paths, wake sensitivity). Add telegram token env-var expansion.
- deploy/telegram.env.example: template for telegram bot token.
- internal/config/config.go: add LLM config struct, voice config struct
  (embedder, llama, wake sensitivity), telegram token loading.
- telegramsink: add chat intent delivery support alongside existing types.
- voicesink: skip empty payloads in delivery.
- dialogue/session: add chat intent to anaphora resolution, test coverage.
- AGENTS.md: update with LLM embedder, LFM model download/configure steps,
  new UI conventions.
- REARCH.md: architecture research document.
- cmd/mavend/main.go: wire LLM config, phraser, embedder, telegram config,
  WebAuthn, IPC event/routine handlers, and reactive notes.

docker-compose.yml

@@ -25,12 +25,23 @@ services:
     <<: *image
     command: ["mavend", "-config", "/opt/maven/config/mavend.json"]
     # the key lives ONLY here. deploy/db_key.env holds MAVEN_DB_KEY=<base64-32B>.
-    env_file: [./deploy/db_key.env]
+    env_file:
+      - ./deploy/db_key.env
+      - ./deploy/telegram.env
     volumes:
       - dbdata:/var/lib/maven                                  # encrypted db at rest
       - sockets:/run/maven                                     # IPC socket dir
       - ./deploy/mavend.json:/opt/maven/config/mavend.json:ro
       - ./models:/opt/maven/models:ro
+      - /mnt/hdd1/llms:/opt/maven/models/llm:ro                # LFM gguf library
+    # the LFM engine (llama-server) offloads onto the AMD iGPU (RADV RENOIR,
+    # Ryzen 5 5600U) via Vulkan — same device + render gid as mavsttd, which
+    # uses the same driver for whisper. Without these Vulkan
+    # enumerates zero devices and llama-server silently falls back to CPU.
+    devices:
+      - "/dev/dri:/dev/dri"
+    group_add:
+      - "993"   # host 'render' gid owning /dev/dri/renderD128 (getent group render)
     # the decrypted working copy lives in RAM (see db_tmpfs in mavend.json).
     tmpfs:
       - /dev/shm