feat: caption-ninja recipe (web pages, private relay, Caption Local STT)

Self-hosted live captioning from steveseguin/captionninja and
steveseguin/caption-local. Upstream publishes no images, so images/build.sh
builds them from pinned commits.

stt-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -e
+
+# Caption Local takes its shared service token from CAPTION_API_KEY only.
+if [ -f /run/secrets/stt_api_key ]; then
+    export CAPTION_API_KEY="$(cat /run/secrets/stt_api_key)"
+fi
+
+# Let the caption.ninja pages on $DOMAIN call this service, plus any extras.
+# Its own page on $STT_DOMAIN must be listed too: Traefik rewrites Host to
+# localhost, so the app no longer sees that page as same-origin.
+origins="https://${DOMAIN},https://${STT_DOMAIN}"
+[ -n "$STT_EXTRA_ORIGINS" ] && origins="${origins},${STT_EXTRA_ORIGINS}"
+export CAPTION_ALLOWED_ORIGINS="$origins"
+
+exec python server.py --host 0.0.0.0 "$@"