fix(scriberr): model caches on /tank; HF_TOKEN is a placeholder (no real credential)

HF_HOME, TORCH_HOME and NLTK_DATA now point under /app/whisperx-env (the
/tank bind mount). Before, ~6 GB of models sat in the container layer and
every recreate threw them away. The cache was copied across (98/2/78 files,
apparent sizes identical).

HF_TOKEN is now a placeholder. Measured: with an invalid token, cached gated
pyannote models still load (huggingface_hub falls back to the cache on the 401),
and public models still download (HTTP 200). Scriberr only checks that the token
is non-empty. Re-verified on GPU 3: pyannote community-1 and WhisperX+3.1
diarization both exit 0 from the /tank cache with no downloads.

stacks/scriberr/README.md

@@ -138,11 +138,11 @@ rebuild — a local patch to carry, which is why it was not done.
 
 Prime: "whisper doesn't work at all, and I need diarized transcripts." There were three separate faults, and all three looked like "transcription is broken":
 
-1. **No Hugging Face token.** pyannote's diarization models are gated. Every diarized job died at the diarize step: WhisperX with `GatedRepoError 401` on `pyannote/speaker-diarization-3.1`, but only after a full CPU transcription (12m45s for a 1 h file), and Parakeet+pyannote with "HuggingFace token is required". **Fix:** `HF_TOKEN` is passed through compose. Its value is in the host `.env` only (vault `fv-ml1/hf-token`, account lkraven, read role; access to `speaker-diarization-3.1`, `segmentation-3.0` and `speaker-diarization-community-1` was checked).
+1. **No Hugging Face token.** pyannote's diarization models are gated. Every diarized job died at the diarize step: WhisperX with `GatedRepoError 401` on `pyannote/speaker-diarization-3.1`, but only after a full CPU transcription (12m45s for a 1 h file), and Parakeet+pyannote with "HuggingFace token is required". **Fix, final form (same day, Prime: "move the downloads and drop the token"):** the gated models were downloaded ONCE with a real token. All model caches now live on /tank (`HF_HOME`, `TORCH_HOME`, `NLTK_DATA` under `/app/whisperx-env`; before this they sat in the container layer and every recreate threw away ~6 GB). `HF_TOKEN` is a **placeholder** in compose, so no real credential lives in Scriberr. Measured: with an invalid token, cached gated models still load (huggingface_hub falls back to the cache on the 401), and public models still download (HTTP 200). The placeholder exists only because Scriberr refuses an EMPTY token. **A new gated model** needs one first download with the real token (vault `fv-ml1/hf-token`).
 2. **The separate pyannote env had a torchcodec that cannot load.** uv resolved torchcodec 0.16.0 beside torch 2.8.0+cu128. 0.16 needs torch ≥2.11 and CUDA 13 (`libnvrtc.so.13`), so pyannote.audio 4 has no decoder and fails with `name 'AudioDecoder' is not defined`. **Fix (live, by hand):** `torchcodec==0.7.*` (its table pairs 0.7 with torch 2.8), pinned in `/tank/scriberr/whisperx-env/pyannote/pyproject.toml`, then `uv lock && uv sync` as uid 10001; the old files are kept as `*.bak-20261006`. Scriberr only rewrites that pyproject if its import test fails at startup. **Durable fix:** `patches/0003-pyannote-env-pin-torchcodec.patch` pins torch/torchaudio 2.8 and torchcodec 0.7 in the embedded pyproject, so it lands at the next rebuild.
 3. **WhisperX defaults to CPU.** The adapter's defaults are `device cpu`, `model small`, `compute_type float32` (`whisperx_adapter.go`). A quick transcribe with no profile ran exactly that. **Use** device `cuda`, model `large-v3`, compute `float16`.
 
-**Verified on a 4-min, multi-speaker clip of a real upload, GPU 3:** WhisperX large-v3/cuda/float16 + `pyannote/speaker-diarization-3.1` exited 0 in 65 s with 2 speakers. The pyannote env script with `speaker-diarization-community-1` (the adapter's only option, used by the Parakeet profile) exited 0 in 11 s with 3 speakers. The two pipelines disagree on the speaker count, so set min/max speakers when you know it. WhisperX's own env (pyannote.audio 4.0.4) loads 3.1 fine and feeds the pipeline in-memory audio, so it never needed torchcodec.
+**Re-verified with the placeholder token and the /tank cache (60 s clip): community-1 exited 0 in 8 s, WhisperX+3.1 exited 0 in 28 s, both 2 speakers, with no downloads and no 401s.** First verification, with the real token, on a 4-min multi-speaker clip of a real upload, GPU 3: WhisperX large-v3/cuda/float16 + `pyannote/speaker-diarization-3.1` exited 0 in 65 s with 2 speakers. The pyannote env script with `speaker-diarization-community-1` (the adapter's only option, used by the Parakeet profile) exited 0 in 11 s with 3 speakers. The two pipelines disagree on the speaker count, so set min/max speakers when you know it. WhisperX's own env (pyannote.audio 4.0.4) loads 3.1 fine and feeds the pipeline in-memory audio, so it never needed torchcodec.
 
 ## Optional: summarisation via the LiteLLM gateway