docker: Liquidsoap radio container (opam-built, version-selectable)

Dockerises the radio_conjurer.liq environment on Debian bookworm:

- Dockerfile.radio builds Liquidsoap through opam with build args for
  OPAM_VERSION (static binary), OCAML_VERSION (default 4.14.2; 2.1.x needs
  OCaml 4.x - prod ran 4.13.0, pass it for parity) and
  LIQUIDSOAP_VERSION (default 2.1.4, matching the script)
- LIQ_OPAM_PACKAGES installs exactly the features the script uses:
  mad+lame (mp3), cry (icecast), taglib (tags/replaygain), pulseaudio
  (mic/out), samplerate, inotify (watch-reload), ffmpeg
- ffmpeg.pref verdict: the Pi pin forced Debian's FFmpeg 5.x family
  (libavcodec59...) over RPi OS repo builds because the ocaml-ffmpeg
  bindings are compiled against those sonames; bookworm ships them
  natively so the container needs no pin (documented, not copied)
- pulse-access/audio group memberships baked in (were manual on the Pi);
  PULSE_MODE=internal runs a system-wide pulse with a null sink so the
  unmodified script works on a headless VM (mic = silence), host mode
  mounts the real socket, none for edited scripts
- mounts mirror the script's hardcoded paths (/home/pi/Conjurer,
  /home/pi/MediaFolder/mp3) so radio_conjurer.liq runs unmodified;
  entrypoint seeds script+params on first run (never overwrites), creates
  missing playlists, seeds placeholder icecast credentials (loud warning)
  and generates a silent emergency mp3 when the single() file is missing
- compose.radio.yaml: extra_hosts maps the script's host="radio" to
  ICECAST_HOST_IP; exposes 54321 (bot's RADIO_HARBOR /skip) and 9999
- docs: radio section with build args, pulse modes and the ffmpeg.pref /
  groups verdicts

Part 2 of this PR (splitting bot<->radio comms out of the musician into a
radio+betoniarka container) follows on this branch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/deployment/DOCKER_PROXMOX.md

@@ -223,6 +223,62 @@ those two files into the same `/srv/musician/data` directory (or set
 `/stream` page template is served from the baked-in `/app/stream.html`
 (override with `CONJURER_STREAM_TEMPLATE` if you customise it).
 
+### 3e. Radio (Liquidsoap) container
+
+`docker/Dockerfile.radio` builds the full Liquidsoap environment through
+**opam**, with the OCaml/opam/Liquidsoap versions selectable at build time:
+
+| Build arg | Default | Notes |
+|-----------|---------|-------|
+| `LIQUIDSOAP_VERSION` | `2.1.4` | what `radio_conjurer.liq` targets |
+| `OCAML_VERSION` | `4.14.2` | 2.1.x needs OCaml **4.x** (never 5); prod ran 4.13.0 — pass it for exact parity |
+| `OPAM_VERSION` | `2.1.5` | static binary from GitHub releases |
+| `LIQ_OPAM_PACKAGES` | `mad lame cry taglib pulseaudio samplerate inotify ffmpeg` | exactly the features the script uses (mp3 in/out, icecast, tags/replaygain, pulse mic/out, watch-reload) |
+
+```bash
+sudo mkdir -p /srv/radio/data /srv/radio/music
+# put the real password in place (otherwise a CHANGE_ME placeholder is seeded):
+echo '{ "password" : "..." }' | sudo tee /srv/radio/data/icecast_credentials.json
+
+ICECAST_HOST_IP=192.168.1.12 docker compose -f docker/compose.radio.yaml up -d --build
+docker logs -f conjurer-radio
+```
+
+The container mounts data at **`/home/pi/Conjurer`** and music at
+**`/home/pi/MediaFolder/mp3`** — the exact paths hardcoded in the script — so
+`radio_conjurer.liq` runs **unmodified**. The script + `script.params` are
+seeded into the volume on first run and never overwritten (live edits
+survive rebuilds). Missing playlists are created empty and a silent
+emergency-fallback mp3 is generated if the `single()` file is absent, so the
+script always boots. `host="radio"` (the icecast output) resolves via the
+compose `extra_hosts` entry — set `ICECAST_HOST_IP`.
+
+Point the bot at this VM: `CONJURER_RADIO_HARBOR=http://RADIO_VM_IP:54321`
+(the harbor `/skip` endpoint lives in the script itself).
+
+**PulseAudio** (`PULSE_MODE` env):
+- `internal` (default) — a system-wide pulse daemon runs inside the container
+  with a **null sink** (`docker/pulse-system.pa`): no sound hardware needed,
+  `output.pulseaudio()` plays into the void and the `input.pulseaudio()` mic
+  path reads silence (which `blank.strip` already gates out). Right choice
+  for a headless Proxmox VM.
+- `host` — mount the host's pulse socket and set `PULSE_SERVER`, for a VM
+  with real audio hardware (the Pi's Lexicon Lambda setup).
+- `none` — you removed the pulse in/out from the script.
+
+**Verdicts on the old Pi setup quirks** (asked during containerisation):
+- `ffmpeg.pref` (Pin-Priority 1001 on the `libavcodec59/libavformat59/…`
+  family): it **did have a purpose** — the opam-built ocaml-ffmpeg bindings
+  for 2.1.x are compiled against Debian bookworm's FFmpeg 5.x sonames, and
+  the pin forced those over conflicting Raspberry Pi OS repo builds (even as
+  a downgrade). In this single-repo container the same versions come
+  naturally, so **no pin is needed** — documented here so it doesn't get
+  cargo-culted forward.
+- adding root to `pulse-access`/`audio` groups: needed on the Pi for the
+  system-wide pulse socket and ALSA device access. The image bakes the same
+  memberships in (`usermod -aG audio,pulse-access root`) — harmless with the
+  internal null sink, required for `PULSE_MODE=host`.
+
 ---
 
 ## 4. Networking & auth