fix(docker): in-container Gemini CLI OAuth, broadcast audio, ports + hardening

Makes the all-in-one image actually run the new real-time-search features and
closes review gaps:
- Gemini OAuth path: install Node 22 + @google/gemini-cli (pinned 0.46.0) in the
  image; mount a DEDICATED host dir (~/.config/javis/gemini) holding only the
  OAuth creds to /root/.gemini (not the whole ~/.gemini). Verified in-container:
  `gemini -p ... -o json` returns a grounded answer with no API key.
- Broadcast audio: add PulseAudio + a headless null-sink (run-pulse.sh, new
  supervisor program); export XDG_RUNTIME_DIR/PULSE_SERVER so Chrome playback
  and the selfbot `ffmpeg -f pulse -i @DEFAULT_MONITOR@` share one daemon.
  Verified: default sink virtual_speaker, monitor present, ffmpeg capture OK.
- Bind the brain bridge to 127.0.0.1 only (internal, unauthenticated API).
- VNC host port is overridable; this server pins VNC_PORT=5902 (.env) since the
  host already runs Xvnc on 5901.

Verified in-container with CDI GPU passthrough: RTX 5050 visible, NVENC
encoders (h264/hevc/av1) available.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker/entrypoint.sh

@@ -20,9 +20,15 @@ set -euo pipefail
 : "${PIPER_VOICE_DIR:=/opt/piper-voices}"
 : "${TTS_PIPER_MODEL_PATH:=${PIPER_VOICE_DIR}/${PIPER_VOICE}.onnx}"
 
+# Audio: shared PulseAudio socket so Chrome (playback) and the selfbot ffmpeg
+# (capture of @DEFAULT_MONITOR@) reach the same headless daemon (run-pulse.sh).
+: "${XDG_RUNTIME_DIR:=/run/user/0}"
+: "${PULSE_SERVER:=unix:${XDG_RUNTIME_DIR}/pulse/native}"
+
 export VNC_RESOLUTION OLLAMA_BASE_URL OLLAMA_CHAT_MODEL OLLAMA_EMBED_MODEL \
        WHISPER_MODEL WHISPER_DEVICE WHISPER_COMPUTE_TYPE JARVIS_DB_PATH \
-       PIPER_VOICE PIPER_VOICE_DIR TTS_PIPER_MODEL_PATH BRIDGE_HOST BRIDGE_PORT
+       PIPER_VOICE PIPER_VOICE_DIR TTS_PIPER_MODEL_PATH BRIDGE_HOST BRIDGE_PORT \
+       XDG_RUNTIME_DIR PULSE_SERVER
 
 mkdir -p /data /app/config "$(dirname "$JARVIS_DB_PATH")"