Dockerize: one-command stack with auto Ollama model pull

`docker compose up -d --build` now brings up the whole thing automatically —
no host setup needed:

- All-in-one javis image: TigerVNC+XFCE desktop, Chrome, Python brain bridge,
  Node/bun bot, managed by supervisord (verified: all 6 programs RUNNING).
- ollama service + one-shot ollama-init that auto-pulls chat+embed models
  (verified end-to-end; `ollama list` shows pulled models).
- Discord token deferred: without DISCORD_BOT_TOKEN the desktop, bridge,
  Ollama and models all run; only the bot waits (no crash loop).
- Slim container deps (bridge/requirements-bridge.txt) drop the unused
  PyQt6/torch/chatterbox/sounddevice stack. Piper voice + Whisper models
  auto-download into named volumes.
- Configurable host ports (VNC_PORT/NOVNC_PORT/BRIDGE_PORT) to avoid clashing
  with a host VNC already on 5901. Bridge binds 0.0.0.0 in-container.

Verified: image builds; brain imports; bridge /health 200; noVNC 200;
X display :1 @1920x1080; auto-pull completes; supervisorctl status all RUNNING.

Dockerfile

@@ -0,0 +1,51 @@
+# ============================================================================
+# Javis Bot — all-in-one container
+# VNC + XFCE desktop + Chrome + Python brain bridge + Node/bun Discord bot.
+# Ollama (the LLM backend) runs as a separate service (see docker-compose.yml).
+# ============================================================================
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    LANG=C.UTF-8 \
+    DISPLAY=:1 \
+    PATH=/opt/venv/bin:/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
+
+# --- System packages: desktop, VNC, Chrome deps, ffmpeg, python, ocr ---
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl wget gnupg unzip procps \
+      tigervnc-standalone-server tigervnc-common tigervnc-tools \
+      xfce4 xfce4-goodies dbus-x11 x11-utils xfonts-base \
+      fonts-noto-cjk fonts-noto-cjk-extra fonts-nanum \
+      ffmpeg tesseract-ocr \
+      python3 python3-venv python3-pip \
+      novnc websockify supervisor gettext-base \
+    && rm -rf /var/lib/apt/lists/*
+
+# --- Google Chrome (stable) ---
+RUN wget -q -O /tmp/chrome.deb https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb \
+    && (apt-get update && apt-get install -y --no-install-recommends /tmp/chrome.deb || (apt-get -f install -y)) \
+    && rm -f /tmp/chrome.deb && rm -rf /var/lib/apt/lists/*
+
+# --- bun (Discord bot runtime/package manager) ---
+RUN curl -fsSL https://bun.sh/install | bash
+
+# --- Python brain/bridge deps (slim set) ---
+COPY bridge/requirements-bridge.txt /app/bridge/requirements-bridge.txt
+RUN python3 -m venv /opt/venv \
+    && /opt/venv/bin/pip install --no-cache-dir --upgrade pip \
+    && /opt/venv/bin/pip install --no-cache-dir -r /app/bridge/requirements-bridge.txt
+
+# --- Discord bot deps (cache layer on lockfile) ---
+COPY bot/package.json bot/bun.lock /app/bot/
+RUN cd /app/bot && bun install --frozen-lockfile || bun install
+
+# --- App source ---
+COPY . /app
+WORKDIR /app
+
+# --- Default Piper voice (best-effort at build; entrypoint retries if absent) ---
+RUN bash docker/download-piper.sh || true
+
+EXPOSE 5901 6080 8765
+
+ENTRYPOINT ["/app/docker/entrypoint.sh"]