chore: sync accumulated infra changes and docs

Removals: openwebui and netclaw compose + Traefik routes (both decommissioned).
Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md
(nodes/ports/known-issues), agent definitions.
Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief,
tls-options and security-headers Traefik config.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compose/gpu-machine/friday-voice/docker-compose.yml

@@ -0,0 +1,49 @@
+# FRIDAY Voice on .150 (Docker Desktop) — replaces VoiceCoach.
+# STT/TTS via local GPU speaches (:8000). Reasoning via the hermes container
+# (invoked through the docker-exec wrapper). Runs as root for socket access.
+services:
+  friday-voice:
+    build:
+      context: .
+      dockerfile: Dockerfile.hermes
+    image: friday-voice-hermes:latest
+    container_name: friday-voice
+    restart: unless-stopped
+    user: "0:0"
+    ports:
+      - "8320:8320"
+    volumes:
+      - friday-voice-data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - DATA_DIR=/data
+      - SPEACHES_URL=http://host.docker.internal:8000
+      - HERMES_COMMAND=/usr/local/bin/hermes-wrap
+      - HERMES_SOURCE=friday-voice
+      - WHISPER_MODEL=deepdml/faster-whisper-large-v3-turbo-ct2
+      - TTS_MODEL=speaches-ai/Kokoro-82M-v1.0-ONNX
+      - TTS_VOICE=af_nova
+      - SPEAKER_CONFIRMED_THRESHOLD=0.85
+      - SPEAKER_PROBABLE_THRESHOLD=0.70
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8320/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "20m"
+        max-file: "3"
+
+volumes:
+  friday-voice-data:
+
+networks:
+  default:
+    name: friday-voice