Dockerize: one-command stack with auto Ollama model pull

`docker compose up -d --build` now brings up the whole thing automatically —
no host setup needed:

- All-in-one javis image: TigerVNC+XFCE desktop, Chrome, Python brain bridge,
  Node/bun bot, managed by supervisord (verified: all 6 programs RUNNING).
- ollama service + one-shot ollama-init that auto-pulls chat+embed models
  (verified end-to-end; `ollama list` shows pulled models).
- Discord token deferred: without DISCORD_BOT_TOKEN the desktop, bridge,
  Ollama and models all run; only the bot waits (no crash loop).
- Slim container deps (bridge/requirements-bridge.txt) drop the unused
  PyQt6/torch/chatterbox/sounddevice stack. Piper voice + Whisper models
  auto-download into named volumes.
- Configurable host ports (VNC_PORT/NOVNC_PORT/BRIDGE_PORT) to avoid clashing
  with a host VNC already on 5901. Bridge binds 0.0.0.0 in-container.

Verified: image builds; brain imports; bridge /health 200; noVNC 200;
X display :1 @1920x1080; auto-pull completes; supervisorctl status all RUNNING.

docker/entrypoint.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Container entrypoint: render config from env, set the VNC password, ensure the
+# Piper voice exists, then hand off to supervisord (which runs the desktop,
+# bridge, and bot).
+set -euo pipefail
+
+# --- Defaults (override via .env / compose) ---
+: "${VNC_PASSWORD:=javis123}"
+: "${VNC_RESOLUTION:=1920x1080}"
+: "${OLLAMA_BASE_URL:=http://ollama:11434}"
+: "${OLLAMA_CHAT_MODEL:=llama3.1:8b}"
+: "${OLLAMA_EMBED_MODEL:=nomic-embed-text}"
+: "${WHISPER_MODEL:=small}"
+: "${WHISPER_DEVICE:=cpu}"
+: "${WHISPER_COMPUTE_TYPE:=int8}"
+: "${JARVIS_DB_PATH:=/data/jarvis.db}"
+: "${BRIDGE_HOST:=0.0.0.0}"
+: "${BRIDGE_PORT:=8765}"
+: "${PIPER_VOICE:=en_GB-alan-medium}"
+: "${PIPER_VOICE_DIR:=/opt/piper-voices}"
+: "${TTS_PIPER_MODEL_PATH:=${PIPER_VOICE_DIR}/${PIPER_VOICE}.onnx}"
+
+export VNC_RESOLUTION OLLAMA_BASE_URL OLLAMA_CHAT_MODEL OLLAMA_EMBED_MODEL \
+       WHISPER_MODEL WHISPER_DEVICE WHISPER_COMPUTE_TYPE JARVIS_DB_PATH \
+       PIPER_VOICE PIPER_VOICE_DIR TTS_PIPER_MODEL_PATH BRIDGE_HOST BRIDGE_PORT
+
+mkdir -p /data /app/config "$(dirname "$JARVIS_DB_PATH")"
+
+# --- VNC password file ---
+mkdir -p /root/.vnc
+echo "$VNC_PASSWORD" | tigervncpasswd -f > /root/.vnc/passwd
+chmod 600 /root/.vnc/passwd
+
+# --- Render jarvis brain config from template ---
+envsubst < /app/docker/jarvis-config.template.json > /app/config/jarvis.json
+export JARVIS_CONFIG_PATH=/app/config/jarvis.json
+
+# --- Ensure the Piper voice exists (best effort) ---
+bash /app/docker/download-piper.sh || echo "[entrypoint] piper download failed; TTS may be unavailable"
+
+echo "[entrypoint] display=$DISPLAY ollama=$OLLAMA_BASE_URL whisper=$WHISPER_MODEL/$WHISPER_DEVICE"
+exec supervisord -c /app/docker/supervisord.conf