docker: Proxmox deployment for bot/librarian/musician + code fixes

Containerises the three services (each intended for its own Proxmox VM)
and adds the code changes needed to run cleanly on Linux/Docker.

Code fixes:
- constants.py: CONJURER_DATA_DIR roots all writable bot state under one
  mounted volume (per-variable overrides still win; native Pi unaffected)
- conjurer_librarian/search_bot.py + scrape_bot.py: the hardcoded Windows
  DOI database path (C:\Database\chunks\) is now CONJURER_LIBRARIAN_DB_PATH,
  with CONJURER_LIBRARIAN_MAXTHREADS / _CHUNK also env-overridable

Docker:
- docker/Dockerfile.{bot,librarian,musician} + compose.{bot,librarian,musician}.yaml
- docker/env/*.env.example (force-added; real *.env stays gitignored)
- docker/entrypoint.bot.sh seeds default JSON state into /data only when
  absent, so preserved history is never overwritten
- .dockerignore
- docs/deployment/DOCKER_PROXMOX.md: step-by-step runbook incl. preserving
  the existing command/conversation history and cross-VM auth

The bot image uses the vendored yt_dlp/spotify_dl forks (they win on
sys.path over the pip packages), dropping the old sed patching.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/env/bot.env.example

@@ -0,0 +1,38 @@
+# Copy to docker/env/bot.env and fill in. Do NOT commit the real file.
+
+# --- Secrets ------------------------------------------------------------
+# Option A: mount a netrc (recommended — covers discord/openai/spotipy/youtube).
+CONJURER_NETRC_FILE=/secrets/.netrc
+# Option B: pass tokens directly (these take precedence over netrc).
+# DISCORD_TOKEN=
+# OPENAI_API_KEY=
+# YOUTUBE_USERNAME=
+# YOUTUBE_PASSWORD=
+
+# --- Data ---------------------------------------------------------------
+# Single mounted volume; all writable state is rooted here.
+CONJURER_DATA_DIR=/data
+
+# --- Flask comm layer (inbound from musician/librarian) -----------------
+CONJURER_DISCORD_HOST=0.0.0.0
+CONJURER_DISCORD_PORT=5000
+
+# --- Internal service auth ----------------------------------------------
+# Set the SAME value on bot + musician + librarian. Empty = auth disabled.
+CONJURER_API_KEY=
+
+# --- Where the bot reaches the other services (other Proxmox VMs) --------
+CONJURER_FILE_SERVICE=http://MUSICIAN_VM_IP:5000
+CONJURER_RADIO_HARBOR=http://MUSICIAN_VM_IP:54321
+CONJURER_LIBRARIAN_SERVICE=http://LIBRARIAN_VM_IP:5001
+
+# --- Conan Exiles bridge (optional; empty/0 = disabled) -----------------
+# CONAN_GM_ROLE_ID=0
+# CONAN_RCON_HOST=
+# CONAN_RCON_PORT=25575
+# CONAN_RCON_PASSWORD=
+# CONAN_CHAT_CHANNEL_ID=0
+# CONAN_EVENTS_CHANNEL_ID=0
+# CONAN_JOIN_CHANNEL_ID=0
+# CONAN_LOG_MODE=local
+# CONAN_LOG_PATH=

docker/env/librarian.env.example

@@ -0,0 +1,21 @@
+# Copy to docker/env/librarian.env and fill in.
+
+CONJURER_LIBRARIAN_HOST=0.0.0.0
+CONJURER_LIBRARIAN_PORT=5001
+
+# Same shared secret as the bot (empty = auth disabled).
+CONJURER_API_KEY=
+
+# Where to POST search results back to (the bot's comm layer).
+CONJURER_MAIN_BOT=http://BOT_VM_IP:5000
+
+# Crossref polite-pool contact (or put credentials in netrc under "crossref").
+CONJURER_CROSSREF_MAILTO=you@example.com
+
+# Local DOI chunk database (mounted volume): expects 0_chunk.txt .. N_chunk.txt
+CONJURER_LIBRARIAN_DB_PATH=/doi/
+CONJURER_LIBRARIAN_MAXTHREADS=41
+CONJURER_LIBRARIAN_CHUNK=_chunk.txt
+
+# Optional netrc (for Crossref credentials)
+CONJURER_NETRC_FILE=/secrets/.netrc

docker/env/musician.env.example

@@ -0,0 +1,17 @@
+# Copy to docker/env/musician.env and fill in.
+
+CONJURER_MUSICIAN_HOST=0.0.0.0
+CONJURER_MUSICIAN_PORT=5000
+
+# Same shared secret as the bot (empty = auth disabled).
+CONJURER_API_KEY=
+
+# Where to POST "now playing" / prepped-track updates (the bot's comm layer).
+CONJURER_MAIN_BOT=http://BOT_VM_IP:5000
+
+# The mp3 library (mounted volume).
+CONJURER_MUSIC_FOLDER=/music
+
+# Runtime paths (mounted volume) — playlists/logs the service writes.
+CONJURER_MUSICIAN_BASE=/data
+CONJURER_LOGSTORE=/data/logs