swarm-stt: the deploy module (deploy.stt.*, sandboxed container, store leaf, queue grants) and its docs

docs/2-handbook/swarm/README.md

@@ -35,6 +35,9 @@ grafana, the controller, authelia, …) →
   they concern: assigned, unassigned, cleared on close; and the classifier's
   review requested on a push. →
   [`notify-router.md`](../../4-implementation/swarm/notify-router.md)
+- **speech-to-text** — voice memos agents receive, turned into text once per
+  memo for the whole swarm. →
+  [`stt.md`](../../4-implementation/swarm/stt.md)
 - **swarm UI** — the operator's day-to-day surface, on the swarm apex,
   `admins` only. → [`ui.md`](ui.md)
 - **shared services** — one forge, homeserver, SSO, queue and metrics/logs

docs/2-handbook/swarm/services.md

@@ -128,6 +128,7 @@ look before you switch them on.
 | Review classifier   | Checks PRs against a repo's review rules.                       | `deploy.review-classifier.enable`                        | [Review classifier](#review-classifier)          |
 | Claude login minter | Runs the **log in** button on an agent's card.                  | `deploy.claude-login.enable`                             | [Claude login minter](#claude-login-minter)      |
 | Notification router | Turns forge events into notifications for agents.               | `deploy.notify-router.enable`                            | [Notification router](#notification-router)      |
+| Speech to text      | Turns voice memos into text for agents.                         | `deploy.stt.enable`                                      | [Speech to text](#notification-router)           |
 
 ### SSO (authelia)
 
@@ -416,3 +417,26 @@ It reaches the queue and the secret store by name, under its own
 `notify-router` leaf. On a host without the store, that leaf is the one file to
 copy, as for the CI runner. The flows and the delivery path are in
 [`notify-router.md`](../../4-implementation/swarm/notify-router.md).
+
+### Speech to text
+
+The speech-to-text service, in a `swarm-stt` container on the host that sets
+`deploy.stt.enable`. `allSwarmServices` defaults it on wherever the host has the
+service's store identity, on the router's terms. Run it where the inference
+hardware is: it transcribes with whisper.cpp.
+
+An agent that receives a voice memo sends the audio to the service over the
+queue, on its own subject, and gets the text back. The service keeps each
+transcript for a day, keyed by a hash of the audio, so the same memo sent to several agents costs
+one whisper run. `deploy.stt.settings.modelSize` picks the
+model (`small` by default, or `base`), and `modelFile` takes any other ggml
+model. The cache time, the limits on file size, audio length and run time, and
+how many requests it holds at once are settings next to it.
+
+The audio comes from rooms with outside people, so the service runs as its own
+unprivileged user under a tight systemd sandbox, with a memory ceiling and
+a CPU quota, and the container reaches the queue, the store and authelia
+and nothing else. The file's first bytes must look like an audio container
+before anything decodes it. Its leaf and its queue client work as the router's
+do. The design, the settings and the reasons are in
+[`stt.md`](../../4-implementation/swarm/stt.md).