Add dockerized whisper.cpp inference server (Vulkan GPU, Tailscale)

- server/whisper-server: compose stack built from the pinned whisper.cpp
  v1.9.3 release, same as the Android JNI layer
- Vulkan GPU backend (AMD Radeon AI PRO R9700 / RADV) with transparent
  CPU fallback and NO_GPU override; GGML models auto-download on first
  start (MODEL env, default large-v3)
- API bound to the Tailscale interface only (100.103.83.12:8080) since
  whisper-server has no authentication; render-group GID passthrough for
  /dev/dri
- validated locally: image builds, entrypoint downloads tiny, POST
  /inference returns verbose_json with language + segments; GPU-less
  fallback confirmed

server/whisper-server/entrypoint.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+# Downloads the configured GGML model on first start, then runs whisper-server.
+# Uses the GPU (Vulkan) automatically when one is present; set NO_GPU=1
+# to force CPU.
+set -eu
+
+MODEL="${MODEL:-small}"
+THREADS="${THREADS:-4}"
+HOST="${HOST:-0.0.0.0}"
+PORT="${PORT:-8080}"
+MODEL_DIR="${MODEL_DIR:-/models}"
+FILE="$MODEL_DIR/ggml-$MODEL.bin"
+
+mkdir -p "$MODEL_DIR"
+if [ ! -s "$FILE" ]; then
+    echo "downloading ggml-$MODEL.bin to $FILE ..."
+    curl -fL --retry 3 -C - -o "$FILE.part" \
+        "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-$MODEL.bin"
+    mv "$FILE.part" "$FILE"
+    echo "done."
+fi
+
+GPU_FLAGS=""
+if [ "${NO_GPU:-0}" = "1" ]; then
+    GPU_FLAGS="-ng"
+fi
+
+echo "starting whisper-server: model=$MODEL threads=$THREADS host=$HOST port=$PORT gpu=auto"
+exec whisper-server \
+    -m "$FILE" \
+    -l auto \
+    -t "$THREADS" \
+    $GPU_FLAGS \
+    --host "$HOST" \
+    --port "$PORT"