feat: deploy LifeOS on hf-pdocker-02 (:8095)

Self-hosted LifeOS (github.com/lifeos-app/lifeos, pinned 3009bf6) in local
mode: no Supabase. Multi-stage build - Node builds the Vite bundle, gunicorn
serves it plus the bundled Flask/SQLite API from one process.

LAN-only on purpose: the backend is single-user with no auth, so anyone who
reaches the port has full read/write. Needs Traefik basicAuth before it can
ever be exposed publicly.

Two upstream bugs patched via sed (build fails loudly if they are renamed):
the chat model was hardcoded to the author's private 'sentient-teddy' bridge,
and a hardcoded 30s timeout failed every first message because Ollama needs
~46s to cold-load the model (0.7s warm). Both are env vars now.

SQLite stays on local disk - NFSv3 breaks WAL locking.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compose/hf-pdocker-02/lifeos/docker-compose.yml

@@ -0,0 +1,32 @@
+services:
+  lifeos:
+    build:
+      context: /opt/lifeos
+      dockerfile: Dockerfile
+    image: lifeos:local
+    container_name: lifeos
+    restart: unless-stopped
+    ports:
+      # 8080 on this node is taken by unifi-os-server.
+      - "8095:8080"
+    environment:
+      - TZ=America/Chicago
+      # AI companion -> Ollama on the GPU machine (OpenAI-compatible endpoint).
+      - AI_BRIDGE_URL=http://192.168.86.150:11434
+      - AI_MODEL=gemma4:latest
+      # Ollama needs ~46s to cold-load gemma4 (0.7s once warm); upstream's
+      # hardcoded 30s timeout would fail every first message.
+      - AI_TIMEOUT=120
+    volumes:
+      # SQLite (WAL) stays on local disk: NFS v3 locking breaks it, same reason
+      # guacamole-db lives on /var/lib.
+      - /var/lib/lifeos:/data/.lifeos
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    mem_limit: 1g
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8080/api/health-check').read()"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 30s