radio: /srv/betoniarka paths, in-container Icecast, drop ffmpeg.pref

Per review of the first radio-container cut:

- radio_conjurer.liq: replace the cargo-culted /home/pi/Conjurer and
  /home/pi/MediaFolder paths with the container layout -
  /srv/betoniarka/data (playlists, script.params, persistence/radio logs),
  /srv/betoniarka/music (library + emergency track) and
  /srv/betoniarka/secrets/icecast_credentials.json;
  interactive.persistent now uses an absolute path;
  output.icecast targets host="localhost" (icecast lives in the container)
- Icecast2 now runs INSIDE the radio container: entrypoint renders
  /etc/icecast2/icecast.xml from docker/icecast.xml.tpl, filling
  source/admin/relay passwords from the secret provisioned at install time
  (same pattern as the bot's netrc); optional admin_password/relay_password
  fields default to password; icecast starts as its unprivileged user;
  port 8000 exposed for listeners; extra_hosts hack removed
- compose.radio.yaml: same-path mounts for /srv/betoniarka/{data,music,secrets}
- ffmpeg.pref removed from the repo (the pin only mattered against the
  RPi OS repo; bookworm ships the right FFmpeg 5.x natively) - verdict
  preserved in the docs and the legacy installer note updated
- docs: updated radio section (volumes, secret provisioning, wire-up)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/entrypoint.radio.sh

@@ -1,12 +1,14 @@
 #!/bin/sh
-# Prepare the radio volumes so radio_conjurer.liq boots on a fresh VM, then
-# start (or point at) PulseAudio and exec liquidsoap. Existing files are never
-# overwritten - live-edited script/params/playlists always win.
+# Prepare the radio volumes, start the in-container Icecast server, wire up
+# PulseAudio and exec liquidsoap. Existing files are never overwritten -
+# live-edited script/params/playlists always win.
 set -e
 
-DATA="${RADIO_DATA_DIR:-/home/pi/Conjurer}"
-MUSIC="${RADIO_MUSIC_DIR:-/home/pi/MediaFolder/mp3}"
-mkdir -p "$DATA" "$MUSIC"
+DATA="${RADIO_DATA_DIR:-/srv/betoniarka/data}"
+MUSIC="${RADIO_MUSIC_DIR:-/srv/betoniarka/music}"
+SECRETS="${RADIO_SECRETS_DIR:-/srv/betoniarka/secrets}"
+CREDS="$SECRETS/icecast_credentials.json"
+mkdir -p "$DATA" "$MUSIC" "$SECRETS"
 
 # Seed the script + persistent interactive params from the image on first run.
 [ -e "$DATA/radio_conjurer.liq" ] || cp /app/radio_conjurer.liq "$DATA/"
@@ -21,14 +23,34 @@ for f in all_playlist.playlist priority_queue.playlist hit.playlist \
     [ -e "$DATA/$f" ] || : > "$DATA/$f"
 done
 
-# Icecast credentials are a secret - never baked into the image. Seed a
-# placeholder so the script can parse the JSON, but shout about it.
-if [ ! -e "$DATA/icecast_credentials.json" ]; then
-    printf '{\n"password" : "CHANGE_ME"\n}\n' > "$DATA/icecast_credentials.json"
-    echo "WARNING: seeded placeholder icecast_credentials.json - the icecast" >&2
-    echo "         output will be rejected until you set the real password!" >&2
+# The icecast secret is provisioned at install time, like the other services'
+# secrets (bot: /srv/conjurer/secrets/.netrc). A placeholder keeps the stack
+# bootable, but both icecast and the stream stay locked until you fix it.
+if [ ! -e "$CREDS" ]; then
+    printf '{\n"password" : "CHANGE_ME"\n}\n' > "$CREDS"
+    echo "WARNING: $CREDS was missing - seeded a CHANGE_ME placeholder." >&2
+    echo "         Put the real password there (see docs) and restart." >&2
 fi
 
+# Render /etc/icecast2/icecast.xml from the template with passwords from the
+# secret. Optional fields admin_password/relay_password default to password.
+SOURCE_PW=$(jq -r '.password' "$CREDS")
+ADMIN_PW=$(jq -r '.admin_password // .password' "$CREDS")
+RELAY_PW=$(jq -r '.relay_password // .password' "$CREDS")
+ICECAST_HOSTNAME="${ICECAST_HOSTNAME:-localhost}"
+sed -e "s|__SOURCE_PASSWORD__|$SOURCE_PW|" \
+    -e "s|__ADMIN_PASSWORD__|$ADMIN_PW|" \
+    -e "s|__RELAY_PASSWORD__|$RELAY_PW|" \
+    -e "s|__HOSTNAME__|$ICECAST_HOSTNAME|" \
+    /app/icecast.xml.tpl > /etc/icecast2/icecast.xml
+chown icecast2:icecast /etc/icecast2/icecast.xml 2>/dev/null || true
+chmod 640 /etc/icecast2/icecast.xml
+
+# Start Icecast in the background as its unprivileged user.
+mkdir -p /var/log/icecast2 && chown -R icecast2:icecast /var/log/icecast2
+su -s /bin/sh icecast2 -c "icecast2 -b -c /etc/icecast2/icecast.xml" \
+    || echo "WARNING: icecast2 failed to start - the stream output will retry" >&2
+
 # single() aborts the whole script when its file is missing; guarantee the
 # emergency fallback exists (5s of silence beats a dead radio).
 EMERGENCY="$MUSIC/Youtube/Dr. Peacock - Trip to Ireland [GvrvQTUbUcA].mp3"