feat: caption-ninja recipe (web pages, private relay, Caption Local STT)

Self-hosted live captioning from steveseguin/captionninja and
steveseguin/caption-local. Upstream publishes no images, so images/build.sh
builds them from pinned commits.

.env.sample

@@ -0,0 +1,39 @@
+TYPE=caption-ninja
+# First deploy downloads the Whisper model; give abra time to converge.
+TIMEOUT=900
+
+# caption.ninja pages (capture, editor, overlay) and the private relay at /relay
+DOMAIN=caption-ninja.example.com
+# Caption Local speech-to-text service (needs its own hostname: it uses absolute paths)
+STT_DOMAIN=stt-caption-ninja.example.com
+
+LETS_ENCRYPT_ENV=production
+
+# Relay room tokens: 32-128 URL-safe chars, all four must differ.
+# "source" = capture -> editor, "output" = editor -> overlay/OBS.
+SECRET_SRC_READ_VERSION=v1 # length=48
+SECRET_SRC_WRITE_VERSION=v1 # length=48
+SECRET_OUT_READ_VERSION=v1 # length=48
+SECRET_OUT_WRITE_VERSION=v1 # length=48
+# Caption Local shared service token (>= 24 chars, no whitespace)
+SECRET_STT_API_KEY_VERSION=v1 # length=48
+
+## Speech-to-text tuning (CPU). See upstream docs/DEPLOYMENT-PROFILES.md.
+## Whisper model: tiny, base, small (default), medium, large-v3. Bigger = more RAM + CPU.
+#CAPTION_MODEL=small
+## Decoder beam width 1-5; 1 is fastest
+#CAPTION_BEAM_SIZE=5
+## Concurrent model workers; threads are per worker. Keep workers*threads <= cores.
+#CAPTION_WORKERS=1
+#CAPTION_THREADS=4
+#CAPTION_MAX_STREAMS=12
+## Set to 1 once the model has downloaded into the volume, to stop Hugging Face lookups
+#CAPTION_OFFLINE=0
+## Metadata-only request logs (no audio/text/tokens)
+#CAPTION_LOG_REQUESTS=0
+
+## Extra exact origins (comma separated, e.g. https://steveseguin.github.io)
+#RELAY_EXTRA_ORIGINS=
+#STT_EXTRA_ORIGINS=
+## Max relay sockets per client IP (everyone shares Traefik's IP)
+#RELAY_PER_IP=512