chore: sync accumulated infra changes and docs

Removals: openwebui and netclaw compose + Traefik routes (both decommissioned).
Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md
(nodes/ports/known-issues), agent definitions.
Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief,
tls-options and security-headers Traefik config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compose/gpu-machine/friday-voice/Dockerfile.hermes

@@ -0,0 +1,17 @@
+# Overlay on the friday-voice app image that adds the docker CLI + a wrapper so
+# the container can reach the hermes agent via `docker exec hermes hermes ...`.
+# Runs as root to access the mounted /var/run/docker.sock.
+FROM friday-voice:latest
+
+USER root
+
+# Static docker *client* only (~small), for `docker exec` into the hermes container.
+RUN curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
+      | tar -xz --strip-components=1 -C /usr/local/bin docker/docker \
+    && chmod +x /usr/local/bin/docker \
+    && docker --version
+
+COPY hermes-wrap /usr/local/bin/hermes-wrap
+RUN chmod +x /usr/local/bin/hermes-wrap
+
+# Keep the base image's CMD (uvicorn friday_voice.app:app :8320).

compose/gpu-machine/friday-voice/docker-compose.yml

@@ -0,0 +1,49 @@
+# FRIDAY Voice on .150 (Docker Desktop) — replaces VoiceCoach.
+# STT/TTS via local GPU speaches (:8000). Reasoning via the hermes container
+# (invoked through the docker-exec wrapper). Runs as root for socket access.
+services:
+  friday-voice:
+    build:
+      context: .
+      dockerfile: Dockerfile.hermes
+    image: friday-voice-hermes:latest
+    container_name: friday-voice
+    restart: unless-stopped
+    user: "0:0"
+    ports:
+      - "8320:8320"
+    volumes:
+      - friday-voice-data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - DATA_DIR=/data
+      - SPEACHES_URL=http://host.docker.internal:8000
+      - HERMES_COMMAND=/usr/local/bin/hermes-wrap
+      - HERMES_SOURCE=friday-voice
+      - WHISPER_MODEL=deepdml/faster-whisper-large-v3-turbo-ct2
+      - TTS_MODEL=speaches-ai/Kokoro-82M-v1.0-ONNX
+      - TTS_VOICE=af_nova
+      - SPEAKER_CONFIRMED_THRESHOLD=0.85
+      - SPEAKER_PROBABLE_THRESHOLD=0.70
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8320/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "20m"
+        max-file: "3"
+
+volumes:
+  friday-voice-data:
+
+networks:
+  default:
+    name: friday-voice

compose/gpu-machine/friday-voice/hermes-wrap

@@ -0,0 +1,5 @@
+#!/bin/sh
+# friday-voice invokes: hermes-wrap chat -q "<text>" --source friday-voice
+# We forward into the hermes container and add -Q (quiet) so only the final
+# response text is returned (no banner/spinner/box art) for clean TTS.
+exec docker exec hermes hermes "$@" -Q