radio: /srv/betoniarka paths, in-container Icecast, drop ffmpeg.pref

Per review of the first radio-container cut:

- radio_conjurer.liq: replace the cargo-culted /home/pi/Conjurer and
  /home/pi/MediaFolder paths with the container layout -
  /srv/betoniarka/data (playlists, script.params, persistence/radio logs),
  /srv/betoniarka/music (library + emergency track) and
  /srv/betoniarka/secrets/icecast_credentials.json;
  interactive.persistent now uses an absolute path;
  output.icecast targets host="localhost" (icecast lives in the container)
- Icecast2 now runs INSIDE the radio container: entrypoint renders
  /etc/icecast2/icecast.xml from docker/icecast.xml.tpl, filling
  source/admin/relay passwords from the secret provisioned at install time
  (same pattern as the bot's netrc); optional admin_password/relay_password
  fields default to password; icecast starts as its unprivileged user;
  port 8000 exposed for listeners; extra_hosts hack removed
- compose.radio.yaml: same-path mounts for /srv/betoniarka/{data,music,secrets}
- ffmpeg.pref removed from the repo (the pin only mattered against the
  RPi OS repo; bookworm ships the right FFmpeg 5.x natively) - verdict
  preserved in the docs and the legacy installer note updated
- docs: updated radio section (volumes, secret provisioning, wire-up)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/Dockerfile.radio

@@ -43,6 +43,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         libavdevice-dev libswresample-dev libswscale-dev libpostproc-dev \
         ffmpeg \
         pulseaudio pulseaudio-utils \
+        icecast2 jq \
     && rm -rf /var/lib/apt/lists/*
 
 # Group membership for PulseAudio/ALSA access. On the Pi this was done by
@@ -75,20 +76,25 @@ RUN liquidsoap --version
 COPY docker/pulse-system.pa /etc/pulse/system.pa
 
 # The script and its persistent params are seeded into the data volume on
-# first run (never overwritten), so live edits survive image rebuilds.
+# first run (never overwritten), so live edits survive image rebuilds. The
+# icecast config is rendered from the template at startup with passwords
+# taken from the secrets volume (never baked into the image).
 WORKDIR /app
 COPY conjurer_musician/radio_conjurer.liq ./radio_conjurer.liq
 COPY conjurer_musician/script.params ./script.params
+COPY docker/icecast.xml.tpl ./icecast.xml.tpl
 COPY docker/entrypoint.radio.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh
 
-# Mount points mirror the paths hardcoded in radio_conjurer.liq, so the
-# script runs unmodified: data at /home/pi/Conjurer, music at
-# /home/pi/MediaFolder/mp3.
-VOLUME ["/home/pi/Conjurer", "/home/pi/MediaFolder/mp3"]
+# Volume layout matches the paths inside radio_conjurer.liq:
+#   /srv/betoniarka/data    - playlists, script.params, persistence/radio logs
+#   /srv/betoniarka/music   - the mp3 library
+#   /srv/betoniarka/secrets - icecast_credentials.json (provisioned at install)
+VOLUME ["/srv/betoniarka/data", "/srv/betoniarka/music", "/srv/betoniarka/secrets"]
 
-# 54321 = harbor /skip (the bot's RADIO_HARBOR), 9999 = interactive harbor.
-EXPOSE 54321 9999
+# 8000 = icecast (listeners), 54321 = harbor /skip (the bot's RADIO_HARBOR),
+# 9999 = interactive harbor.
+EXPOSE 8000 54321 9999
 
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
-CMD ["liquidsoap", "/home/pi/Conjurer/radio_conjurer.liq"]
+CMD ["liquidsoap", "/srv/betoniarka/data/radio_conjurer.liq"]