feat(blender): Blender 5.2.2 LTS on fv-ml1 GPU 3, on demand (Prime)

Uses linuxserver/blender (Selkies Wayland desktop, NVENC), digest-pinned. The
container sees only GPU 3, has restart "no", and runs only while in use,
because GPU 3 is the reserve card for a full-size vLLM seat. Web desktop on
:3001 with basic auth (vault fv-ml1/blender-web-password). /work is on /tank
and is not backed up; /config lives under /opt/docker (restic).

Acceptance: Cycles finds the card on OptiX and CUDA (sm_120 kernels ship in the
build). The heavy self-test renders in 3.54 s on OptiX vs 22.71 s on CPU, a
functional check with n=1. Web auth answers 401 without credentials and with a
wrong password, and 200 with the right one.

stacks/blender/.env.example

@@ -0,0 +1,6 @@
+# blender — copy to /opt/docker/compose/blender/.env on fv-ml1 (mode 0600).
+IMAGE=lscr.io/linuxserver/blender:5.2.2-ls241@sha256:9216c77ab2bf38a758390f802c5777554df605c53456dbcad828509a27a8f28b
+HTTPS_PORT=3001
+# Basic auth for the web desktop. PASSWORD source of truth: secret get fv-ml1/blender-web-password
+CUSTOM_USER=blender
+PASSWORD=