feat: caption-ninja recipe (web pages, private relay, Caption Local STT)

Self-hosted live captioning from steveseguin/captionninja and
steveseguin/caption-local. Upstream publishes no images, so images/build.sh
builds them from pinned commits.

relay-entrypoint.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+set -e
+
+# The relay reads one private JSON file holding allowed origins and per-room
+# tokens. Build it from the Docker secrets at startup so tokens never live in
+# the recipe or the env file. Writes to /tmp, readable only by the node user.
+umask 077
+node - > /tmp/rooms.json <<'JS'
+const fs = require('node:fs');
+const secret = name => fs.readFileSync('/run/secrets/' + name, 'utf8').trim();
+const origins = [process.env.DOMAIN, process.env.STT_DOMAIN]
+  .filter(Boolean).map(host => 'https://' + host)
+  .concat((process.env.RELAY_EXTRA_ORIGINS || '').split(',').map(s => s.trim()).filter(Boolean));
+const config = {
+  origins: [...new Set(origins)],
+  rooms: {
+    source: {read: secret('src_read'), write: secret('src_write')},
+    output: {read: secret('out_read'), write: secret('out_write')},
+  },
+  // Every client arrives via Traefik, so they all share one source IP; the
+  // upstream default of 128 sockets per IP would cap the whole audience.
+  limits: {perIp: Number(process.env.RELAY_PER_IP || 512)},
+};
+process.stdout.write(JSON.stringify(config));
+JS
+
+export CAPTION_RELAY_CONFIG=/tmp/rooms.json
+exec node server.cjs