althing-chamber: scaffold deploy stack on ana-docker

Two-service compose (chamber + forseti sidecar daemon) sharing a single
SQLite store via bind-mount under /opt/docker/conf/althing-chamber/data.
eventbus.bridge_from_db is the cross-process glue — forseti's commits
reach chamber's SSE subscribers via the bridge.

Pattern matches task-board's build-on-host deploy:
  - elway playbook clones vh/althing into /opt/docker/build/
  - docker build -t althing-chamber:local . (no registry)
  - playbook uploads compose + seeds .env one-time, brings both
    services up, polls /health
  - Gitea Actions workflow lives in vh/althing; reference copy here.

Internal tooling — host port 7881 (chamber's default of 7878 collides
with task-board). LAN-direct, no Traefik. Container always listens on
8000 internally.

Scaffold will fail to bring the chamber container up healthy until
galdrabok-side commits land:
  - Dockerfile at vh/althing repo root (two-stage: uv-bookworm-slim
    build → python:3.12-slim runtime, locked per open_questions §2
    of the v1 contract).
  - GET /health endpoint on the chamber app (200, no DB read).
  - ALTHING_BIND / ALTHING_PORT env-var support in
    core.cli.chamber_serve / core.chamber.cli (env > config.yaml >
    defaults precedence).

Coordinated via althing thread 01KRMAK7RD7TP6C8DF4KXV31RT.

stacks/althing-chamber/.env.example

@@ -0,0 +1,27 @@
+# althing-chamber stack tunables. Copy to `.env` on ana-docker before deploying.
+#
+# The deploy playbook seeds `.env` from this template on first run only —
+# it won't clobber an existing `.env`.
+
+# Image tag. Built locally from the vh/althing git repo by the playbook.
+ALTHING_IMAGE=althing-chamber:local
+
+# Host port exposing the chamber UI (container always listens on 8000
+# internally). Internal-only — no Traefik.
+# Chamber's compiled-in default port is 7878 but that collides with
+# task-board's 7878 on the same host. 7881 is the canonical fleet slot,
+# adjacent to task-board:7878 and vor:7879.
+ALTHING_PORT=7881
+
+# Bind address for the host port. 0.0.0.0 = LAN-reachable (default for an
+# internal-only tool).
+ALTHING_BIND=0.0.0.0
+
+# Host path for SQLite + state. Container runs as uid 1000 (matches
+# lkraven on these hosts) so the playbook's mkdir without sudo produces
+# a writable dir.
+#
+# This single dir is the only persistent state — althing's SQLite DB,
+# read_cursors, notification_state, hand_queue, floor_grants all live
+# here. Restic backs it up via the standard /opt/docker tree.
+ALTHING_DATA_DIR=/opt/docker/conf/althing-chamber/data