feat: build from captions.coop/captions-deploy, translation models, relay auto-fill

- images/build.sh builds all three images from one pinned captions-deploy
  commit (submodules pin the captions.coop forks; web/Dockerfile is the UI).
- app: UI image configured by env (landing page, site-config.js), translation
  models downloaded into a volume on start (TRANSLATION_MODELS).
- stt: RELAY_AUTOFILL=source|all|off feeds the capture page's /relay-config.
- Drops the recipe's own nginx.conf and web Dockerfile.

stt-entrypoint.sh

@@ -13,4 +13,19 @@ origins="https://${DOMAIN},https://${STT_DOMAIN}"
 [ -n "$STT_EXTRA_ORIGINS" ] && origins="${origins},${STT_EXTRA_ORIGINS}"
 export CAPTION_ALLOWED_ORIGINS="$origins"
 
+# Relay auto-fill: the capture page fetches these from /relay-config (behind the
+# service token). "source" shares only the capture room's tokens; "all" also
+# shares the editor output tokens, letting service-token holders publish to the
+# audience room without review; "off" disables it.
+secret() { cat "/run/secrets/$1"; }
+case "${RELAY_AUTOFILL:-source}" in
+    source|all)
+        export RELAY_ADDRESS="wss://${DOMAIN}/relay" RELAY_SITE="https://${DOMAIN}/"
+        export RELAY_SOURCE_WRITE="$(secret src_write)" RELAY_SOURCE_READ="$(secret src_read)"
+        if [ "$RELAY_AUTOFILL" = "all" ]; then
+            export RELAY_OUTPUT_WRITE="$(secret out_write)" RELAY_OUTPUT_READ="$(secret out_read)"
+        fi
+        ;;
+esac
+
 exec python server.py --host 0.0.0.0 "$@"