Add rage table-flip state; wire gateway to live Speaches; add CI pipeline

- Face: new 'rage' state — 3-frame kaomoji loop (stare, flip the table,
  put it back) for in-flight request failures; 'error' stays the quiet
  persistent face for a dead link. Sim + artifact + design doc updated.
- Gateway: stt.py/tts.py are now pluggable backends. Default 'speaches'
  talks OpenAI-format HTTP to the live container on :8601
  (faster-whisper-small STT, Kokoro bm_george TTS with 24->16 kHz
  audioop resample); 'embedded' fallback kept behind the [speech] extra.
  Verified with a live TTS->STT round trip (warm: STT 0.27s, TTS 1.9s).
  Docker image is now slim (no CUDA/ML deps). Python pinned to 3.12
  (system 3.8 too old, audioop gone in 3.13).
- CI: .gitea/workflows/build.yml — lint+test on main pushes; on v* tags
  test, build gateway image, push to registry, release, and trigger
  Watchtower (tatlock pattern; needs REGISTRY_USER/REGISTRY_PASSWORD/
  WATCHTOWER_TOKEN secrets). Runtime stack in deploy/desklock-gateway.yml.
- architecture.md: measured speech latencies, deployed-Speaches status,
  CI & deployment section.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/desklock-gateway.yml

@@ -0,0 +1,21 @@
+# DeskLock gateway stack.
+# To deploy: copy into system-admin-toj/containers/stacks/ (Portainer) and
+# register the service + port 8600 in CONTAINERS.md.
+#
+# Image is built and pushed by .gitea/workflows/build.yml on version tags;
+# Watchtower picks up :latest afterwards.
+services:
+  desklock-gateway:
+    image: git.schweitz.internal/jpmschweitzer/desklock-gateway:latest
+    container_name: desklock-gateway
+    restart: unless-stopped
+    ports:
+      - "8600:8600"
+    environment:
+      # LAN IP of tower-of-joy: *.schweitz.internal resolves to localhost on the
+      # host, which is wrong inside a container. Switch to http://speaches:8000
+      # (and the tatlock service name) if this stack joins their docker networks.
+      - DESKLOCK_TATLOCK_BASE_URL=http://192.168.86.149:8000
+      - DESKLOCK_SPEACHES_BASE_URL=http://192.168.86.149:8601
+    labels:
+      - com.centurylinklabs.watchtower.enable=true