Add rage table-flip state; wire gateway to live Speaches; add CI pipeline

- Face: new 'rage' state — 3-frame kaomoji loop (stare, flip the table,
  put it back) for in-flight request failures; 'error' stays the quiet
  persistent face for a dead link. Sim + artifact + design doc updated.
- Gateway: stt.py/tts.py are now pluggable backends. Default 'speaches'
  talks OpenAI-format HTTP to the live container on :8601
  (faster-whisper-small STT, Kokoro bm_george TTS with 24->16 kHz
  audioop resample); 'embedded' fallback kept behind the [speech] extra.
  Verified with a live TTS->STT round trip (warm: STT 0.27s, TTS 1.9s).
  Docker image is now slim (no CUDA/ML deps). Python pinned to 3.12
  (system 3.8 too old, audioop gone in 3.13).
- CI: .gitea/workflows/build.yml — lint+test on main pushes; on v* tags
  test, build gateway image, push to registry, release, and trigger
  Watchtower (tatlock pattern; needs REGISTRY_USER/REGISTRY_PASSWORD/
  WATCHTOWER_TOKEN secrets). Runtime stack in deploy/desklock-gateway.yml.
- architecture.md: measured speech latencies, deployed-Speaches status,
  CI & deployment section.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AGENTS.md

@@ -13,10 +13,11 @@ one repo:
   (3.4" round 800×800 touch display, dual mics + ES7210 AEC, ES8311 codec + speaker).
 - `gateway/` — Python FastAPI container on tower-of-joy orchestrating STT → chat
   (Tatlock `/v1/chat/completions`) → TTS. Listens on port **8600**. STT/TTS models live
-  in a shared **Speaches** container (proposed port 8601, OpenAI-format API), not in the
-  gateway image; `stt.py`/`tts.py` are pluggable backends (`speaches` default,
-  `embedded` fallback for dev). See docs/architecture.md — the scaffold currently
-  implements only `embedded`.
+  in the shared **Speaches** container (live on port 8601, OpenAI-format API), not in
+  the gateway image; `stt.py`/`tts.py` are pluggable backends (`speaches` default,
+  `embedded` fallback needing the `[speech]` extra). Gateway runs on **Python 3.12
+  exactly** — system python3 on tower-of-joy is 3.8, and `audioop` (used for TTS
+  resampling) is removed in 3.13.
 
 The device and gateway speak a WebSocket protocol defined in `docs/architecture.md`.
 **That doc is the contract** — update it in the same change as any protocol edit on
@@ -87,9 +88,16 @@ make typecheck      # mypy
   and defaults.
 - `stt.py` / `tts.py` defer their heavy imports so the app boots without the `speech`
   extra — keep it that way so protocol tests stay fast.
-- Deployment: Docker image built from `gateway/Dockerfile`, deployed like other
-  tower-of-joy stacks (see `/mnt/media/Projects/system-admin-toj/containers/`). Register
-  the service + port in `CONTAINERS.md` when it first deploys.
+- Deployment is CI-driven: pushing a `v*` tag makes Gitea Actions test, build, and push
+  `desklock-gateway:{latest,tag}` to the registry and trigger Watchtower
+  (`.gitea/workflows/build.yml`; needs `REGISTRY_USER`/`REGISTRY_PASSWORD`/
+  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The stack
+  file is `deploy/desklock-gateway.yml` — copy into
+  `system-admin-toj/containers/stacks/` and register the service + port 8600 in
+  `CONTAINERS.md` on first deploy.
+- Verify speech changes against the live Speaches container with a real round trip
+  (TTS → STT of a known phrase, expect the transcript back); warm timings to expect:
+  STT ~0.3 s, TTS ~2 s per sentence.
 
 ## Homelab context