feat(deploy): add brain/app roles for GPU-split deployment

Run the GPU-heavy compute (Whisper STT, Ollama LLM, TTS) on a dedicated
brain host and the bot + browser on a separate no-GPU app host, talking
over the LAN.

- supervisord: new `brain` role (bridge only) and `app` role (bot +
  desktop/Chrome, no local bridge); `full`/`browser`/`bot` unchanged.
- compose: make BRIDGE_URL overridable (was hardcoded to loopback, which
  prevented the bot from reaching a remote bridge).
- docs: DEPLOY.md "GPU split" layout with per-host .env blocks; document
  the new roles in run-if-role.sh and .env.example.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker/run-if-role.sh

@@ -11,6 +11,10 @@
 #   JARVIS_ROLE=browser  only the desktop + Chrome + CDP (reused over the LAN)
 #   JARVIS_ROLE=bot      only the bot + bridge + TTS (drives a remote browser
 #                        via CDP_HOST/CDP_PORT)
+#   JARVIS_ROLE=brain    only the bridge (STT + reply + TTS) on a GPU host; no
+#                        bot, no desktop. The app host reaches it via BRIDGE_URL.
+#   JARVIS_ROLE=app      the bot + desktop/Chrome, but NOT the local bridge:
+#                        offloads STT/LLM/TTS to a remote brain host (BRIDGE_URL)
 set -e
 want="$1"; shift
 role="${JARVIS_ROLE:-full}"