docker: Proxmox deployment for bot/librarian/musician + code fixes

Containerises the three services (each intended for its own Proxmox VM)
and adds the code changes needed to run cleanly on Linux/Docker.

Code fixes:
- constants.py: CONJURER_DATA_DIR roots all writable bot state under one
  mounted volume (per-variable overrides still win; native Pi unaffected)
- conjurer_librarian/search_bot.py + scrape_bot.py: the hardcoded Windows
  DOI database path (C:\Database\chunks\) is now CONJURER_LIBRARIAN_DB_PATH,
  with CONJURER_LIBRARIAN_MAXTHREADS / _CHUNK also env-overridable

Docker:
- docker/Dockerfile.{bot,librarian,musician} + compose.{bot,librarian,musician}.yaml
- docker/env/*.env.example (force-added; real *.env stays gitignored)
- docker/entrypoint.bot.sh seeds default JSON state into /data only when
  absent, so preserved history is never overwritten
- .dockerignore
- docs/deployment/DOCKER_PROXMOX.md: step-by-step runbook incl. preserving
  the existing command/conversation history and cross-VM auth

The bot image uses the vendored yt_dlp/spotify_dl forks (they win on
sys.path over the pip packages), dropping the old sed patching.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/compose.librarian.yaml

@@ -0,0 +1,20 @@
+# Librarian VM. Run from the repository root:
+#   cp docker/env/librarian.env.example docker/env/librarian.env   # then edit
+#   docker compose -f docker/compose.librarian.yaml up -d --build
+services:
+  conjurer-librarian:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.librarian
+    image: conjurer-librarian:latest
+    container_name: conjurer-librarian
+    restart: unless-stopped
+    env_file:
+      - env/librarian.env
+    ports:
+      - "5001:5001"
+    volumes:
+      # Local DOI chunk database (0_chunk.txt ... N_chunk.txt).
+      - /srv/librarian/doi:/doi:ro
+      # Optional: netrc holding Crossref credentials (or use CONJURER_CROSSREF_MAILTO).
+      - /srv/librarian/secrets/.netrc:/secrets/.netrc:ro