feat(deploy): Docker + Linux server deployment

Multi-stage Dockerfile (builder → export → runtime) producing a 149 MB
Ubuntu 24.04 image, verified booting end-to-end on Docker Desktop.  vcpkg
fetched via shallow git fetch at the pinned baseline, release-only overlay
triplets (x64-linux, arm64-linux) to halve intermediate disk usage, and
buildtrees deleted within the RUN layer so they never land in the image or
the BuildKit cache.  Binary cache mount (VCPKG_BINARY_SOURCES) makes
subsequent rebuilds restore pre-built packages instead of recompiling.

Also adds:
- docker-compose.yml for one-command local deploy
- .dockerignore (excludes clients/, build/, .git/)
- .github/workflows/build-linux.yml — CI cross-build for amd64 + arm64
  with downloadable artifacts (primary path for building from Windows)
- scripts/build-linux-binaries.sh — local Docker binary extraction fallback
- deploy/linux/voicecat.service — hardened systemd unit for bare-metal
- cmake/voicecat-toolchain.cmake now auto-wires VCPKG_OVERLAY_TRIPLETS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/build-linux-binaries.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# build-linux-binaries.sh — build stripped Linux server binaries locally using Docker.
+#
+# PRIMARY path: push to main (or trigger manually from the GitHub Actions tab) and
+# download the artifacts from .github/workflows/build-linux.yml — no local disk
+# pressure, both amd64 and arm64 handled in the cloud.
+#
+# LOCAL path (this script): uses Docker + buildx with BuildKit cache.  Requires
+# ~10–15 GB of free disk for the vcpkg build cache.  Fine on a Linux dev machine;
+# on Windows/macOS prefer the GitHub Actions path to avoid filling your Docker VM disk.
+#
+# Usage:
+#   ./scripts/build-linux-binaries.sh            # build both arches
+#   ./scripts/build-linux-binaries.sh amd64      # build one arch only
+#   ./scripts/build-linux-binaries.sh arm64
+#
+# Output:
+#   dist/linux-amd64/{voicecat-server,voicecat-admin}
+#   dist/linux-arm64/{voicecat-server,voicecat-admin}
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+DIST_DIR="${REPO_ROOT}/dist"
+
+# ── arg parsing ────────────────────────────────────────────────────────────────
+case "${1:-both}" in
+    amd64) ARCHS=("amd64") ;;
+    arm64) ARCHS=("arm64") ;;
+    both)  ARCHS=("amd64" "arm64") ;;
+    *)     echo "Usage: $0 [amd64|arm64|both]" >&2; exit 1 ;;
+esac
+
+# ── pre-flight ─────────────────────────────────────────────────────────────────
+if ! command -v docker &>/dev/null; then
+    echo "Error: docker not found." >&2
+    echo "Install Docker Desktop: https://docs.docker.com/get-docker/" >&2
+    echo "Or use GitHub Actions (push to main and download artifacts)." >&2
+    exit 1
+fi
+
+if ! docker buildx version &>/dev/null; then
+    echo "Error: docker buildx not available." >&2
+    echo "Docker Desktop ships with buildx.  On Linux: docker buildx install" >&2
+    exit 1
+fi
+
+echo "Note: first run compiles vcpkg packages from source (~10-15 GB build cache)."
+echo "On Windows/macOS, consider using GitHub Actions instead (Actions → Build Linux Binaries → Run workflow)."
+echo ""
+
+# ── ensure a builder with multi-platform support ───────────────────────────────
+BUILDER="voicecat-builder"
+if ! docker buildx inspect "${BUILDER}" &>/dev/null; then
+    echo "→ Creating buildx builder '${BUILDER}' (docker-container driver)..."
+    docker buildx create --name "${BUILDER}" --driver docker-container --bootstrap
+fi
+docker buildx use "${BUILDER}"
+
+# ── build each arch ────────────────────────────────────────────────────────────
+for ARCH in "${ARCHS[@]}"; do
+    PLATFORM="linux/${ARCH}"
+    OUT_DIR="${DIST_DIR}/linux-${ARCH}"
+    mkdir -p "${OUT_DIR}"
+
+    echo "══ Building ${PLATFORM} ══════════════════════════════════════════════════"
+    if [[ "${ARCH}" == "arm64" ]] && [[ "$(uname -m)" != "aarch64" ]]; then
+        echo "   (Running under QEMU on a non-arm64 host — will be slow)"
+    fi
+
+    docker buildx build \
+        --platform "${PLATFORM}" \
+        --target export \
+        --output "type=local,dest=${OUT_DIR}" \
+        --progress plain \
+        "${REPO_ROOT}"
+
+    echo "→ ${PLATFORM} binaries:"
+    ls -lh "${OUT_DIR}/"
+    echo ""
+done
+
+echo "════════════════════════════════════════════════════════════════════════════"
+echo "Done. Binaries in dist/:"
+for ARCH in "${ARCHS[@]}"; do
+    ls -lh "${DIST_DIR}/linux-${ARCH}/"
+done