asset-engine + irv-ml1: scaffold orchestrator wiring

Three changes prepping infra for asset_engine's orchestration feature
(SSH-driven bring-up / bring-down of irv-ml1 inference services with
per-device VRAM gating, contract in vh/asset-engine commit 5a36f8c):

1. asset-engine compose + .env.example + playbook gain a read-only
   bind-mount for /app/runtime/ssh — the dedicated ed25519 keypair
   (generated on ana-docker, not in the repo) plus a pinned known_hosts
   for irv-ml1's host fingerprint. Env vars SSH_KEY_PATH and
   SSH_KNOWN_HOSTS are exposed for the app to consume.

2. docs/asset-engine/services.yaml gains a `lifecycle: { stack, vram_gb,
   gpu_device_id }` block on each of 12 orchestratable irv-ml1 services
   (kokoro, chatterbox, index-tts, qwen3-tts, cosyvoice, fish-s2,
   kyutai-tts, vibevoice, voxtral, parakeet, stable-audio-open, ace-step).
   VRAM numbers are estimates from model footprint at fp16 — tune from
   real nvidia-smi measurements once the gate is live. comfyui and
   kokoro-captioned are deliberately excluded (variable-VRAM and
   shared-container respectively).

3. servers/irv-ml1/README.md docker-stacks table now lists all 13
   inference stacks (was only dockge + agents + comfyui) with port +
   GPU pinning columns.

Pubkey deployed to ~lkraven/.ssh/authorized_keys on irv-ml1;
end-to-end SSH from ana-docker → irv-ml1 verified with strict
host-key checking.

playbooks/deploy-asset-engine.yaml

@@ -26,6 +26,7 @@ vars:
   compose_dir: /opt/docker/compose/asset-engine
   db_dir: /opt/docker/conf/asset-engine/db
   outputs_dir: /opt/docker/conf/asset-engine/outputs
+  ssh_dir: /opt/docker/conf/asset-engine/ssh
   host_port: "8200"
 
 steps:
@@ -90,6 +91,11 @@ steps:
     shell: mkdir -p {{ outputs_dir }}
     creates: "{{ outputs_dir }}"
 
+  - name: Ensure SSH key dir exists (parent only — keys themselves are seeded
+          out-of-band on the host so the private key never crosses the network)
+    shell: mkdir -p {{ ssh_dir }} && chmod 700 {{ ssh_dir }}
+    creates: "{{ ssh_dir }}"
+
   # ── deploy compose files ────────────────────────────────────────────
   - name: Upload compose.yaml
     upload: