chore: docker, config, delivery sinks, dialogue, and agent docs

- Dockerfile: multi-stage build with CGO_ENABLED=0, embedder model copy,
  non-root user, healthcheck, and /data volume.
- docker-compose.yml: mavend + mavweb services with shared volume, health
  checks, and restart policy.
- .gitignore: ignore models/llm/*.gguf, deploy/telegram.env, tmp artifacts.
- deploy/mavend.json: add LLM, phraser, voice sections (embedder, model
  paths, wake sensitivity). Add telegram token env-var expansion.
- deploy/telegram.env.example: template for telegram bot token.
- internal/config/config.go: add LLM config struct, voice config struct
  (embedder, llama, wake sensitivity), telegram token loading.
- telegramsink: add chat intent delivery support alongside existing types.
- voicesink: skip empty payloads in delivery.
- dialogue/session: add chat intent to anaphora resolution, test coverage.
- AGENTS.md: update with LLM embedder, LFM model download/configure steps,
  new UI conventions.
- REARCH.md: architecture research document.
- cmd/mavend/main.go: wire LLM config, phraser, embedder, telegram config,
  WebAuthn, IPC event/routine handlers, and reactive notes.

internal/config/config.go

@@ -335,8 +335,12 @@ func Load(path string) (*Config, error) {
 	if err != nil {
 		return nil, fmt.Errorf("config: read %s: %w", path, err)
 	}
+	// Expand ${VAR} or $VAR patterns from environment variables. This lets
+	// secrets live in env (docker-compose env_file) rather than the config
+	// file committed to git.
+	expanded := os.ExpandEnv(string(b))
 	var c Config
-	if err := json.Unmarshal(b, &c); err != nil {
+	if err := json.Unmarshal([]byte(expanded), &c); err != nil {
 		return nil, fmt.Errorf("config: parse %s: %w", path, err)
 	}
 	c.applyDefaults()