Directive 1: voice intake watchdog (layer attribution, daily repeat, Apprise)

Build the Hub Fixes Directive 1 watchdog as a small standalone service on .13.

- Watch voice/audio_stream (paho); 15 min silence = 3 missed heartbeats.
- Attribute failures in order: broker -> voice_bridge -> ESP32/no-publisher.
  The ESP32 is never blamed when the broker or the bridge broke.
- Alert via Apprise on .35:8210 (tag sam_ntfy; daily repeat escalates to sam).
- Persist state; repeat once a day while broken; recovery notice; alerts stop.
- No auto-heal of any kind. Notification only.
- Require publisher evidence (heartbeat or retained presence) before treating
  silence as a failure, so the unflashed Directive 3 firmware cannot cause the
  cry-wolf false alarms the spec warns about.
- Docker: host network, read-only Docker socket, state volume, unless-stopped.
- 23 unit tests; live evidence captured in watchdog/README.md.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

watchdog/Dockerfile

@@ -0,0 +1,14 @@
+FROM python:3.12-slim
+
+# paho-mqtt only. Apprise is reached over plain HTTP with urllib, and the Docker
+# socket is read through the stdlib http.client, so there is no other dependency.
+RUN pip install --no-cache-dir "paho-mqtt==2.1.0"
+
+WORKDIR /app
+COPY watchdog.py /app/watchdog.py
+
+# The service only reads state; the compose file provides the state volume and
+# the (read-only) Docker socket.
+VOLUME ["/var/lib/voice_intake_watchdog"]
+
+CMD ["python", "-u", "/app/watchdog.py"]