docker: Proxmox deployment for bot/librarian/musician + code fixes

Containerises the three services (each intended for its own Proxmox VM)
and adds the code changes needed to run cleanly on Linux/Docker.

Code fixes:
- constants.py: CONJURER_DATA_DIR roots all writable bot state under one
  mounted volume (per-variable overrides still win; native Pi unaffected)
- conjurer_librarian/search_bot.py + scrape_bot.py: the hardcoded Windows
  DOI database path (C:\Database\chunks\) is now CONJURER_LIBRARIAN_DB_PATH,
  with CONJURER_LIBRARIAN_MAXTHREADS / _CHUNK also env-overridable

Docker:
- docker/Dockerfile.{bot,librarian,musician} + compose.{bot,librarian,musician}.yaml
- docker/env/*.env.example (force-added; real *.env stays gitignored)
- docker/entrypoint.bot.sh seeds default JSON state into /data only when
  absent, so preserved history is never overwritten
- .dockerignore
- docs/deployment/DOCKER_PROXMOX.md: step-by-step runbook incl. preserving
  the existing command/conversation history and cross-VM auth

The bot image uses the vendored yt_dlp/spotify_dl forks (they win on
sys.path over the pip packages), dropping the old sed patching.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/env/librarian.env.example

@@ -0,0 +1,21 @@
+# Copy to docker/env/librarian.env and fill in.
+
+CONJURER_LIBRARIAN_HOST=0.0.0.0
+CONJURER_LIBRARIAN_PORT=5001
+
+# Same shared secret as the bot (empty = auth disabled).
+CONJURER_API_KEY=
+
+# Where to POST search results back to (the bot's comm layer).
+CONJURER_MAIN_BOT=http://BOT_VM_IP:5000
+
+# Crossref polite-pool contact (or put credentials in netrc under "crossref").
+CONJURER_CROSSREF_MAILTO=you@example.com
+
+# Local DOI chunk database (mounted volume): expects 0_chunk.txt .. N_chunk.txt
+CONJURER_LIBRARIAN_DB_PATH=/doi/
+CONJURER_LIBRARIAN_MAXTHREADS=41
+CONJURER_LIBRARIAN_CHUNK=_chunk.txt
+
+# Optional netrc (for Crossref credentials)
+CONJURER_NETRC_FILE=/secrets/.netrc