radio: /srv/betoniarka paths, in-container Icecast, drop ffmpeg.pref

Per review of the first radio-container cut:

- radio_conjurer.liq: replace the cargo-culted /home/pi/Conjurer and
  /home/pi/MediaFolder paths with the container layout -
  /srv/betoniarka/data (playlists, script.params, persistence/radio logs),
  /srv/betoniarka/music (library + emergency track) and
  /srv/betoniarka/secrets/icecast_credentials.json;
  interactive.persistent now uses an absolute path;
  output.icecast targets host="localhost" (icecast lives in the container)
- Icecast2 now runs INSIDE the radio container: entrypoint renders
  /etc/icecast2/icecast.xml from docker/icecast.xml.tpl, filling
  source/admin/relay passwords from the secret provisioned at install time
  (same pattern as the bot's netrc); optional admin_password/relay_password
  fields default to password; icecast starts as its unprivileged user;
  port 8000 exposed for listeners; extra_hosts hack removed
- compose.radio.yaml: same-path mounts for /srv/betoniarka/{data,music,secrets}
- ffmpeg.pref removed from the repo (the pin only mattered against the
  RPi OS repo; bookworm ships the right FFmpeg 5.x natively) - verdict
  preserved in the docs and the legacy installer note updated
- docs: updated radio section (volumes, secret provisioning, wire-up)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/deployment/DOCKER_PROXMOX.md

@@ -235,26 +235,42 @@ those two files into the same `/srv/musician/data` directory (or set
 | `OPAM_VERSION` | `2.1.5` | static binary from GitHub releases |
 | `LIQ_OPAM_PACKAGES` | `mad lame cry taglib pulseaudio samplerate inotify ffmpeg` | exactly the features the script uses (mp3 in/out, icecast, tags/replaygain, pulse mic/out, watch-reload) |
 
-```bash
-sudo mkdir -p /srv/radio/data /srv/radio/music
-# put the real password in place (otherwise a CHANGE_ME placeholder is seeded):
-echo '{ "password" : "..." }' | sudo tee /srv/radio/data/icecast_credentials.json
+The container runs **both Liquidsoap and Icecast** — the stream is served
+from this one container (`output.icecast(host="localhost", …)` in the
+script). Volume layout (same paths inside and outside):
 
-ICECAST_HOST_IP=192.168.1.12 docker compose -f docker/compose.radio.yaml up -d --build
+| Host & container path | Holds |
+|---|---|
+| `/srv/betoniarka/data` | playlists, `script.params`, `persistence.log`, `radio_log.log`, the seeded `radio_conjurer.liq` |
+| `/srv/betoniarka/music` | the mp3 library |
+| `/srv/betoniarka/secrets` | `icecast_credentials.json` — **provision at install**, like the other services' secrets |
+
+```bash
+sudo mkdir -p /srv/betoniarka/data /srv/betoniarka/music /srv/betoniarka/secrets
+# provision the icecast secret (same pattern as the bot's netrc):
+echo '{ "password" : "SOURCE_PW", "admin_password" : "ADMIN_PW" }' \
+  | sudo tee /srv/betoniarka/secrets/icecast_credentials.json
+sudo chmod 600 /srv/betoniarka/secrets/icecast_credentials.json
+
+docker compose -f docker/compose.radio.yaml up -d --build
 docker logs -f conjurer-radio
 ```
 
-The container mounts data at **`/home/pi/Conjurer`** and music at
-**`/home/pi/MediaFolder/mp3`** — the exact paths hardcoded in the script — so
-`radio_conjurer.liq` runs **unmodified**. The script + `script.params` are
-seeded into the volume on first run and never overwritten (live edits
-survive rebuilds). Missing playlists are created empty and a silent
-emergency-fallback mp3 is generated if the `single()` file is absent, so the
-script always boots. `host="radio"` (the icecast output) resolves via the
-compose `extra_hosts` entry — set `ICECAST_HOST_IP`.
+At startup the entrypoint renders `/etc/icecast2/icecast.xml` from
+`docker/icecast.xml.tpl`, filling the source/admin/relay passwords from the
+secret (`admin_password`/`relay_password` are optional and default to
+`password`), and starts icecast as its unprivileged user. If the secret is
+missing, a `CHANGE_ME` placeholder is seeded with a loud warning — the stack
+boots but the stream stays locked until you fix it.
 
-Point the bot at this VM: `CONJURER_RADIO_HARBOR=http://RADIO_VM_IP:54321`
-(the harbor `/skip` endpoint lives in the script itself).
+The script + `script.params` are seeded into the data volume on first run
+and never overwritten (live edits survive rebuilds). Missing playlists are
+created empty and a silent emergency-fallback mp3 is generated if the
+`single()` file is absent, so the script always boots.
+
+Wire-up: listeners tune to `http://RADIO_VM_IP:8000/mp3-stream`; the bot
+points at `CONJURER_RADIO_HARBOR=http://RADIO_VM_IP:54321` (harbor `/skip`
+lives in the script itself).
 
 **PulseAudio** (`PULSE_MODE` env):
 - `internal` (default) — a system-wide pulse daemon runs inside the container
@@ -272,8 +288,8 @@ Point the bot at this VM: `CONJURER_RADIO_HARBOR=http://RADIO_VM_IP:54321`
   for 2.1.x are compiled against Debian bookworm's FFmpeg 5.x sonames, and
   the pin forced those over conflicting Raspberry Pi OS repo builds (even as
   a downgrade). In this single-repo container the same versions come
-  naturally, so **no pin is needed** — documented here so it doesn't get
-  cargo-culted forward.
+  naturally, so the pin is redundant — **the file has been removed from the
+  repo** (this note preserves the knowledge).
 - adding root to `pulse-access`/`audio` groups: needed on the Pi for the
   system-wide pulse socket and ALSA device access. The image bakes the same
   memberships in (`usermod -aG audio,pulse-access root`) — harmless with the