Add local Whisper speech recognition

platform/docker/whisper/entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -eu
+
+model=${WHISPER_MODEL:-/models/ggml-large-v3-turbo.bin}
+model_url=${WHISPER_MODEL_URL:-https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-large-v3-turbo.bin}
+model_dir=$(dirname "$model")
+
+mkdir -p "$model_dir"
+chown 10004:10004 "$model_dir"
+
+if [ ! -s "$model" ]; then
+  partial="${model}.part"
+  echo "Downloading Whisper model to persistent storage"
+  # All writes below must use the volume owner. The container deliberately
+  # drops CAP_DAC_OVERRIDE, so even uid 0 cannot rename a file in the
+  # whisper-owned directory after capabilities have been removed.
+  if [ ! -s "$partial" ]; then
+    gosu whisper rm -f "$partial"
+    gosu whisper curl --fail --location --retry 5 --retry-delay 5 \
+      --output "$partial" "$model_url"
+  fi
+  gosu whisper mv "$partial" "$model"
+fi
+
+exec gosu whisper python /app/stt_worker.py