feat(arbo): add irv-ml1 co-located engine stack (ADR-0001)

New stack mirroring the canonical convention for the Arbo (catalog) engine,
co-located beside comfyui on irv-ml1 per ADR-0001 D1/D3:

- engine<->ComfyUI over traefik-net container DNS (http://comfyui:8188),
  SSH dependency eliminated; file ops bind the shared basedir input/output
- named local-disk volumes for the gallery SQLite (arbo_db, restic-backed)
  and hero images (arbo_heroes); catalog as a ro git-checkout mount (D2)
- ENGINE_TOKEN + GRANITE_KEY via on-host .env; GRANITE via the LiteLLM gateway
- Q5 catalog-pull: manual day-1, ytvc-style webhook follow-on

Image build, /healthz, catalog in-container path, and non-root UID are
comfy-dev's to confirm (CONFIRM items in README).

stacks/arbo/.env.example

@@ -0,0 +1,26 @@
+# Arbo engine — real .env lives on irv-ml1 (gitignored), this is the template.
+# Copy to .env on the host and fill the secrets. See README.md for provisioning.
+
+# Image comfy-dev builds + pushes (pin a tag; bump on code/schema change only):
+ARBO_IMAGE=gitea.phasefinal.com/vh/arbo:0.11.0
+
+# Published port on irv-ml1 (reachable over WireGuard at 10.100.79.3:<port>):
+ARBO_PORT=8200
+ARBO_BIND=0.0.0.0
+
+# Run-as ownership — must match /worktank owner so basedir writes land clean:
+ARBO_UID=1000
+ARBO_GID=1000
+
+# Host path of the comfy-dev catalog checkout (the git pull target, mounted ro):
+ARBO_CATALOG_DIR=/worktank/arbo/repo
+
+# ── Secrets (DO NOT COMMIT REAL VALUES) ──────────────────────────────
+# ENGINE_TOKEN: a real bearer token — auth is OPEN until this is set.
+#   Mint a fresh one:  openssl rand -hex 32
+ENGINE_TOKEN=
+
+# GRANITE_KEY: the LiteLLM virtual key scoped to arbo (granite-only).
+#   comfy-dev already holds 'arbo-prompt-enhance' (issued 2026-06-09) —
+#   reuse or rotate it; do NOT use the master sk-corvid key.
+GRANITE_KEY=