vor: stack + playbook + workflow template for ana-docker deploy

Same shape as task-board: build-on-host from vh/vor, bind-mounted
persistence for sessions/ and responses/ (the user-published markdown
files), exposed at port 7879 (adjacent to task-board's 7878 since both
are claude-tooling sidecars).

Workflow template assumes the same DEPLOY_SSH_KEY + MGMT_REPO_TOKEN
secrets at user scope; nothing new to provision. Playbook accepts SHA
or branch refs (same fix as deploy-task-board.yaml) so manual runs
and CI runs share the same code path.

Centralized vs upstream-local: README documents the trade. Claude
fetches response markdown via /api/sessions/{id} JSON instead of a
local file read — the only API-flow change from the upstream README.

stacks/vor/compose.yaml

@@ -0,0 +1,45 @@
+# vor — Inquisitor UI sidecar.
+#
+# Image is built on the host from the vor git repo by the deploy
+# playbook (`playbooks/deploy-vor.yaml`), which clones into
+# /opt/docker/build/vor and runs `docker build -t vor:local .` before
+# installing this compose and bringing it up.
+#
+# Sessions + responses persist under bind mounts so container rebuilds
+# don't lose user-published response files (which Claude reads via the
+# /api/sessions/{id} JSON path).
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  vor:
+    image: ${VOR_IMAGE}
+    container_name: vor
+    restart: unless-stopped
+    ports:
+      - "${VOR_BIND:-0.0.0.0}:${VOR_PORT}:8765"
+    volumes:
+      - ${VOR_SESSIONS_DIR}:/app/sessions
+      - ${VOR_RESPONSES_DIR}:/app/responses
+    environment:
+      # Container always listens on 8765 internally; host port is the only knob.
+      - PYTHONUNBUFFERED=1
+    healthcheck:
+      test: ["CMD-SHELL", "python -c 'import urllib.request,sys; r=urllib.request.urlopen(\"http://127.0.0.1:8765/api/sessions\",timeout=3); sys.exit(0 if r.status==200 else 1)' || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    networks:
+      - tnet
+    labels:
+      - homepage.group=Toolchain
+      - homepage.name=vor
+      - homepage.icon=mdi-clipboard-text-search
+      - homepage.description=Inquisitor UI — Claude session ↔ user response sidecar
+      - homepage.href=http://10.250.50.70:${VOR_PORT}
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true