feat(docker): bundle whisper.cpp + tiny model for out-of-the-box transcription

[jkyberneees]

Summary

Makes voice transcription work out of the box in the Docker image. The transcribe tool and Telegram voice auto-transcription previously required the host to have whisper.cpp + a model installed (or a first-run download). Now the image ships everything: the whisper.cpp CLI, the ggml tiny model, and ffmpeg.

Changes

docker/Dockerfile

• New whisper build stage compiles whisper-cli from source (same alpine base as runtime for musl ABI match; GGML_OPENMP=OFF so the only runtime shared lib needed is libstdc++) and fetches ggml-tiny.bin.
• Model is overridable at build time: --build-arg WHISPER_MODEL=base|small|medium.
• Runtime stage adds ffmpeg (OGG/Opus → WAV for whisper) + libstdc++, and copies whisper-cli onto PATH and the model to /usr/local/share/whisper/models/.

docker/config.restricted.json + docker/config.godmode.json

• Add a transcription block: model: tiny, auto_transcribe: true, models_dir: /usr/local/share/whisper/models.

Docs — docker/README.md and docs/TELEGRAM.md document the bundled setup.

Why the model lives outside ~/.odek

The default model location is ~/.odek/whisper/models, but the Telegram compose profiles bind-mount ./.odek over /home/odek/.odek — which would shadow a model baked under ~/.odek, breaking exactly the profiles (voice notes) that need it. So the model is baked to a fixed image path (/usr/local/share/whisper/models) and the configs point transcription.models_dir there, keeping it visible across all four profiles.

Verification

Built the image locally and confirmed, running as the non-root odek user:

• whisper-cli is on PATH and executes (ldd → only libstdc++/libgcc_s + musl)
• the tiny model is readable at the configured path
• ffmpeg is present
• full end-to-end: generated an OGG/Opus clip → ffmpeg to WAV → whisper-cli --output-json inference with the bundled model, JSON written ✅

Image size impact: ~78 MB model + ~2.7 MB binary + ffmpeg/libstdc++.

🤖 Generated with Claude Code

[jkyberneees]

Pre-merge verification pass ✅

Re-verified end to end before merge:

Build (reproducible)

• No-cache build of the pinned whisper stage → git describe = v1.8.6; produced whisper-cli (2.7 MB) + ggml-tiny.bin (77 MB).
• Pinned to a tagged release (WHISPER_VERSION=v1.8.6) instead of tracking master, so the build can't drift in CI.

Runtime (as non-root odek user)

• whisper-cli on PATH and executes; ldd shows only libstdc++/libgcc_s + musl (both covered by the libstdc++ apk pkg).
• ffmpeg present; model readable at /usr/local/share/whisper/models/ggml-tiny.bin.
• Full inference smoke test: OGG/Opus → ffmpeg → WAV → whisper-cli --output-json with the bundled model ✅

Config delivery (compose)

• Web (godmode): config.json carries the transcription block (models_dir → baked path); model present; whisper resolves.
• Telegram: ./.odek bind-mount is active and the model is not shadowed (it lives outside .odek) — confirming the design choice.

Unit tests

• cmd/odek transcribe tests pass, incl. TestTranscribe_MockHappyPath (models_dir + model: tiny → resolves ggml-tiny.bin), validating the exact resolution path the shipped config relies on.