docker: Proxmox deployment for bot/librarian/musician + code fixes

Containerises the three services (each intended for its own Proxmox VM)
and adds the code changes needed to run cleanly on Linux/Docker.

Code fixes:
- constants.py: CONJURER_DATA_DIR roots all writable bot state under one
  mounted volume (per-variable overrides still win; native Pi unaffected)
- conjurer_librarian/search_bot.py + scrape_bot.py: the hardcoded Windows
  DOI database path (C:\Database\chunks\) is now CONJURER_LIBRARIAN_DB_PATH,
  with CONJURER_LIBRARIAN_MAXTHREADS / _CHUNK also env-overridable

Docker:
- docker/Dockerfile.{bot,librarian,musician} + compose.{bot,librarian,musician}.yaml
- docker/env/*.env.example (force-added; real *.env stays gitignored)
- docker/entrypoint.bot.sh seeds default JSON state into /data only when
  absent, so preserved history is never overwritten
- .dockerignore
- docs/deployment/DOCKER_PROXMOX.md: step-by-step runbook incl. preserving
  the existing command/conversation history and cross-VM auth

The bot image uses the vendored yt_dlp/spotify_dl forks (they win on
sys.path over the pip packages), dropping the old sed patching.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/Dockerfile.bot

@@ -0,0 +1,56 @@
+# Conjurer main Discord bot.
+# Build from the repository root:
+#   docker build -f docker/Dockerfile.bot -t conjurer-bot .
+FROM python:3.11-slim
+
+# System dependencies:
+#   ffmpeg        - audio download/convert (yt_dlp) and Discord voice
+#   libopus0      - Discord voice (PyNaCl / discord-ext-voice-recv)
+#   poppler-utils - pdf2image (librarian/latex previews)
+#   git           - required by the git+https entry in requirements
+#   build-essential - native wheels (PyNaCl etc.)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ffmpeg \
+        libopus0 \
+        poppler-utils \
+        git \
+        build-essential \
+        curl \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Optional: Tectonic for the $latex command. Remove this layer if unused.
+RUN curl -fsSL https://drop-sh.fullyjustified.net | sh \
+    && mv tectonic /usr/local/bin/tectonic \
+    || echo "tectonic not installed - the LaTeX feature will be disabled"
+
+COPY requirements_bot.txt ./
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir -r requirements_bot.txt
+
+# Vendored forks take import precedence over the pip packages of the same name,
+# because /app (the script dir) is first on sys.path when running `python bot.py`.
+COPY yt_dlp ./yt_dlp
+COPY spotify_dl ./spotify_dl
+
+# Bot sources + default config/asset templates. Runtime state (conversation
+# history etc.) is read from the mounted /data volume via CONJURER_DATA_DIR,
+# so these committed copies only act as first-run fallbacks.
+COPY *.py ./
+COPY settings.json system_gpt_settings.json accident_log.json pamiec.json pamiec_muzyki.json ./
+COPY fuckery.jpg willowisp.png wod_beacon.jpg ./
+COPY docker/entrypoint.bot.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+ENV PYTHONUNBUFFERED=1 \
+    CONJURER_DATA_DIR=/data \
+    CONJURER_DISCORD_HOST=0.0.0.0 \
+    CONJURER_DISCORD_PORT=5000
+
+VOLUME ["/data"]
+EXPOSE 5000
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["python", "bot.py"]