feat(augaman): deploy v0.1.1 on esh-ml1:8040 (face recognition for Cicada)

Mirror pfi/augaman deploy/compose.yaml as stacks/augaman, with an .env.example and
a README carrying the biometric backup gate. The image is built on esh-ml1 from a
git archive of the release tag, because the box holds no gitea credentials.

Serving on CUDA and visible in nvidia-smi. The gallery backup is not wired yet
(esh-ml1 has no restic), so only public-domain fixtures may be enrolled.
The on-box gpu test fails its batch-vs-single tolerance 3/3; reported to
augaman-dev, who owns the contract.

stacks/augaman/.env.example

@@ -0,0 +1,21 @@
+# augaman — copy to .env on the host at /opt/docker/compose/augaman/.env (mode 0600).
+# Real .env is gitignored and lives only on esh-ml1.
+#
+# ⚠ Compose's own variables carry NO `AUGAMAN_` prefix on purpose: the app refuses any
+# AUGAMAN_* variable it does not know, and compose passes only the ones named in
+# compose.yaml. Do not add an env_file.
+
+# Built locally on esh-ml1 from the release tag (see README "Building").
+IMAGE=augaman:0.1.1
+
+PORT=8040
+HOST_IP=10.0.50.80
+
+# Where the backup CLI writes gallery.db. Owned 10001:10001 (the container user),
+# mode 0700. It is the restic stage dir, so the backup run that copies the gallery here
+# is the same run that ships it off-box (README "Backup").
+BACKUP_DIR=/var/lib/restic/stage/augaman
+
+# >= 32 visible-ASCII characters. Source of truth is the vault:
+#   secret get augaman/api-token
+AUGAMAN_API_TOKEN=