asset-engine + irv-ml1: scaffold orchestrator wiring

Three changes prepping infra for asset_engine's orchestration feature
(SSH-driven bring-up / bring-down of irv-ml1 inference services with
per-device VRAM gating, contract in vh/asset-engine commit 5a36f8c):

1. asset-engine compose + .env.example + playbook gain a read-only
   bind-mount for /app/runtime/ssh — the dedicated ed25519 keypair
   (generated on ana-docker, not in the repo) plus a pinned known_hosts
   for irv-ml1's host fingerprint. Env vars SSH_KEY_PATH and
   SSH_KNOWN_HOSTS are exposed for the app to consume.

2. docs/asset-engine/services.yaml gains a `lifecycle: { stack, vram_gb,
   gpu_device_id }` block on each of 12 orchestratable irv-ml1 services
   (kokoro, chatterbox, index-tts, qwen3-tts, cosyvoice, fish-s2,
   kyutai-tts, vibevoice, voxtral, parakeet, stable-audio-open, ace-step).
   VRAM numbers are estimates from model footprint at fp16 — tune from
   real nvidia-smi measurements once the gate is live. comfyui and
   kokoro-captioned are deliberately excluded (variable-VRAM and
   shared-container respectively).

3. servers/irv-ml1/README.md docker-stacks table now lists all 13
   inference stacks (was only dockge + agents + comfyui) with port +
   GPU pinning columns.

Pubkey deployed to ~lkraven/.ssh/authorized_keys on irv-ml1;
end-to-end SSH from ana-docker → irv-ml1 verified with strict
host-key checking.

stacks/asset-engine/.env.example

@@ -22,6 +22,13 @@ ASSET_ENGINE_BIND=0.0.0.0
 ASSET_ENGINE_DB_DIR=/opt/docker/conf/asset-engine/db
 ASSET_ENGINE_OUTPUTS_DIR=/opt/docker/conf/asset-engine/outputs
 
+# SSH key dir for orchestrating irv-ml1 services (bring up / down via SSH +
+# docker compose). Holds id_ed25519 (mode 600) + known_hosts (mode 644)
+# pre-populated with irv-ml1's pinned ed25519 fingerprint. Generated on the
+# host directly so the private key never crosses the network. Bind-mounted
+# read-only into the container at /app/runtime/ssh.
+ASSET_ENGINE_SSH_DIR=/opt/docker/conf/asset-engine/ssh
+
 # Inference target. Default is irv-ml1 over WG. Override if the fleet's
 # inference host moves.
 INFERENCE_HOST=10.100.79.3

stacks/asset-engine/compose.yaml

@@ -15,8 +15,9 @@
 #
 # Internal tooling — accessed directly on host:port over the LAN, does
 # NOT traverse Traefik. State persists under /opt/docker/conf/asset-engine/
-# {db,outputs} on the host — separate bind-mounts so outputs/ can move
-# to a bigger volume later without touching DB state.
+# {db,outputs,ssh} on the host — db/outputs are separate bind-mounts so
+# outputs/ can move to a bigger volume later without touching DB state;
+# ssh/ holds the dedicated keypair used to orchestrate irv-ml1 services.
 #
 # All tunables live in .env — edit that, not this file.
 
@@ -36,9 +37,15 @@ services:
       - OIDC_ISSUER=${OIDC_ISSUER:-}
       - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
       - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
+      # Orchestration SSH paths inside the container.
+      - SSH_KEY_PATH=/app/runtime/ssh/id_ed25519
+      - SSH_KNOWN_HOSTS=/app/runtime/ssh/known_hosts
     volumes:
       - ${ASSET_ENGINE_DB_DIR}:/app/runtime/db
       - ${ASSET_ENGINE_OUTPUTS_DIR}:/app/runtime/outputs
+      # Dedicated SSH key for orchestrating irv-ml1 services (up/down).
+      # Read-only; key is generated on the host, never crosses the network.
+      - ${ASSET_ENGINE_SSH_DIR}:/app/runtime/ssh:ro
     healthcheck:
       test: ["CMD-SHELL", "python -c 'import urllib.request,sys; r=urllib.request.urlopen(\"http://127.0.0.1:8000/health\",timeout=3); sys.exit(0 if r.status==200 else 1)' || exit 1"]
       interval: 30s