feat(augaman): deploy v0.1.1 on esh-ml1:8040 (face recognition for Cicada)

Mirror pfi/augaman deploy/compose.yaml as stacks/augaman, with an .env.example and
a README carrying the biometric backup gate. The image is built on esh-ml1 from a
git archive of the release tag, because the box holds no gitea credentials.

Serving on CUDA and visible in nvidia-smi. The gallery backup is not wired yet
(esh-ml1 has no restic), so only public-domain fixtures may be enrolled.
The on-box gpu test fails its batch-vs-single tolerance 3/3; reported to
augaman-dev, who owns the contract.

stacks/augaman/compose.yaml

@@ -0,0 +1,67 @@
+# augaman: the fleet's face-recognition service for Cicada (gitea pfi/augaman), on esh-ml1
+# (CT 110 on esh-pve, RTX 2000E Ada 16 GB). Enroll, recognize, verify; buffalo_l (SCRFD +
+# ArcFace w600k_r50) on ONNX Runtime CUDA. Canonical copy: this file in pfi/augaman; the
+# eshpfi stack mirrors it as stacks/augaman.
+#
+# ⚠ BIOMETRIC DATA. The gallery volume holds face embeddings and crops of household members.
+#   - The live SQLite stays on the local named volume. Never NFS (the service refuses it).
+#   - esh-ml1 is OUTSIDE vzdump. The gallery reaches backup only through the backup CLI,
+#     writing to BACKUP_DIR, a restic-covered host path. Wire the schedule and VERIFY A
+#     RESTORE before real people are enrolled (operator ruling):
+#       docker exec augaman python -m augaman.gallery.backup --db /data/gallery.db --dest /backup/gallery.db
+#     It prints one JSON line and exits 0, or "backup failed: ..." and exits 1.
+#   - BACKUP_DIR must be writable by uid 10001, the container user. Backups are mode 0600.
+#
+# Startup refuses to serve unless CUDA really runs every convolution: a profiled warmup plus
+# ORT's CPU fallbacks turned off. /health reports backend "cuda" only then. Confirm once by the
+# process in `nvidia-smi` on the host. Warmup, including the first CUDA inference, is covered
+# by the healthcheck's start_period.
+#
+# Only AUGAMAN_* variables reach the app, and it refuses any it does not know, so compose's own
+# variables below carry no AUGAMAN_ prefix and are never passed through wholesale (no env_file).
+#
+# .env (tunables): IMAGE, PORT (8040), BACKUP_DIR, HOST_IP (10.0.50.80), AUGAMAN_API_TOKEN
+#   (>= 32 visible-ASCII characters; the source of truth is the vault).
+
+name: augaman
+
+services:
+  augaman:
+    image: ${IMAGE:?set IMAGE}
+    container_name: augaman
+    restart: unless-stopped
+    ports:
+      - "${PORT:-8040}:8040"
+    environment:
+      AUGAMAN_API_TOKEN: ${AUGAMAN_API_TOKEN:?set AUGAMAN_API_TOKEN}
+      AUGAMAN_DEVICE: cuda
+      AUGAMAN_CUDA_DEVICE_ID: "0"
+    volumes:
+      - gallery:/data
+      - ${BACKUP_DIR:?set BACKUP_DIR}:/backup
+    # Multipart spools of large uploads land here: RAM only, never persistent disk (api INV-A07).
+    tmpfs:
+      - /tmp:size=512m
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              device_ids: ["0"]
+              capabilities: [gpu]
+    healthcheck:
+      # 200 only when ready and not degraded; a 503 (degraded) fails the check.
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8040/health', timeout=5)"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 180s
+    labels:
+      - homepage.group=AI - Eval & Retrieval
+      - homepage.name=augaman — face recognition
+      - homepage.icon=mdi-face-recognition
+      - homepage.description=Enroll, recognize, verify (buffalo_l on CUDA) for Cicada
+      - homepage.href=http://${HOST_IP:-10.0.50.80}:${PORT:-8040}/health
+
+volumes:
+  gallery: