feat(diariz): pilot stack on fv-ml1 GPU 3 — override (GPU pin, api port), vault-rendered .env, nightly idle-gated worker restart, fleet caddy site

stacks/diariz/docker-compose.override.yml

@@ -0,0 +1,35 @@
+# Diariz on fv-ml1 — the fleet's override of upstream deploy/docker-compose.yml (kenhayward/Diariz @ 5a96cad).
+# Lives BESIDE the upstream file in /opt/docker/src/diariz-<sha7>/deploy/ (Compose loads docker-compose.override.yml
+# automatically); /opt/docker/compose/diariz is a symlink to that deploy dir. Canonical copy: eshpfi stacks/diariz/.
+services:
+  api:
+    # Upstream pins host port 8080, which Scriberr already holds on fv-ml1 (0.0.0.0:8080). The browser never needs
+    # it: the web container's nginx proxies /api and /hubs to api:8080 on the stack network. Loopback only, for debugging.
+    ports: !override
+      - "127.0.0.1:18080:8080"
+  web:
+    labels:
+      - homepage.group=AI - Studios
+      - homepage.name=Diariz
+      - homepage.icon=mdi-account-voice
+      - homepage.description=Live diarized meeting transcription (pilot; fv-ml1, GPU3)
+      - homepage.href=https://diariz.nh3.phasefinal.com
+  # GPU 3 by explicit device id (upstream reserves `count: all`, which would expose all four cards, and torch would
+  # default to cuda:0 = the vLLM seats' GPU 0). Prime 2026-10-19: GPU 3 is OK for Diariz as an exception to the
+  # "no always-resident tenant on GPU 3" rule; the workers are restarted nightly (~0300) to drop their cached models.
+  worker:
+    deploy:
+      resources:
+        reservations:
+          devices: !override
+            - driver: nvidia
+              device_ids: ["3"]
+              capabilities: [gpu]
+  live-worker:
+    deploy:
+      resources:
+        reservations:
+          devices: !override
+            - driver: nvidia
+              device_ids: ["3"]
+              capabilities: [gpu]