feat(albok-service): unit 6 sealed wing personal/sealed — LUKS2 volume, gid 1513, rslave bind of /srv/albok/sealed

albok-dev's host ask under Prime's goal "land all of u6". A 20 GiB LUKS2 file
with ext4, keyed only from the vault (piped over ssh, never on the host's
disk). The mountpoint is immutable while unmounted, and the mounted root is
1500:1513 0750 with .albok-wing. The parent is bound into the container with
rslave propagation: a lock then unlock with the service running showed through
without a restart. The wing is not in albok.yaml yet (albok-dev's release).
Runbook and backup posture are in the README.

stacks/albok-service/compose.yaml

@@ -13,6 +13,7 @@
 # ⚠ Nothing else may mount /srv/albok/store read-write. Viewers mount it :ro with group_add by gid
 #   (1510 albok-read, 1511 albok-personal) and need GIT_OPTIONAL_LOCKS=0 + a safe.directory entry.
 #   1512 albok-feedback (restricted wing personal/agent-feedback) is default-deny: no viewer gets it.
+#   1513 albok-sealed (encrypted wing personal/sealed, unit 6) likewise; its plaintext exists only while unlocked.
 services:
   albok-service:
     image: gitea.phasefinal.com/pfi/albok-service:0.1.23@sha256:026de87f3ca3907e9eb0a2a2489a7507f69f9f0eca50e8e8be3fcfcb36a03de3
@@ -25,12 +26,20 @@ services:
       - "1510"
       - "1511"
       - "1512"   # albok-feedback: restricted wing personal/agent-feedback
+      - "1513"   # albok-sealed: encrypted wing personal/sealed (unit 6, 2026-10-16)
     volumes:
       - /srv/albok/store:/srv/albok/store
       - /srv/albok/private:/srv/albok/private
       - /srv/albok/etc/albok.yaml:/etc/albok/albok.yaml:ro
       # the read groups must RESOLVE BY NAME inside the container (layout.py uses grp.getgrnam)
       - /opt/docker/conf/albok-service/group:/etc/group:ro
+      # Unit 6 encrypted wings: the PARENT of the LUKS mountpoints, bound with slave propagation, so a wing unlocked
+      # (cryptsetup open + mount) after the container started is visible inside it without a restart (README § Sealed).
+      - type: bind
+        source: /srv/albok/sealed
+        target: /srv/albok/sealed
+        bind:
+          propagation: rslave
     mem_limit: 8g   # 4g on nh3-docker (7.7 GiB shared host); 12 GiB VM to itself now
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8390/health', timeout=5).status == 200 else 1)"]