Directive 1: voice intake watchdog (layer attribution, daily repeat, Apprise)

Build the Hub Fixes Directive 1 watchdog as a small standalone service on .13.

- Watch voice/audio_stream (paho); 15 min silence = 3 missed heartbeats.
- Attribute failures in order: broker -> voice_bridge -> ESP32/no-publisher.
  The ESP32 is never blamed when the broker or the bridge broke.
- Alert via Apprise on .35:8210 (tag sam_ntfy; daily repeat escalates to sam).
- Persist state; repeat once a day while broken; recovery notice; alerts stop.
- No auto-heal of any kind. Notification only.
- Require publisher evidence (heartbeat or retained presence) before treating
  silence as a failure, so the unflashed Directive 3 firmware cannot cause the
  cry-wolf false alarms the spec warns about.
- Docker: host network, read-only Docker socket, state volume, unless-stopped.
- 23 unit tests; live evidence captured in watchdog/README.md.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

watchdog/start_watchdog.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Start the voice intake watchdog.
+#
+# environment.d reaches the systemd user manager, not a fresh SSH shell, so the
+# secrets file is sourced here the same way ~/voice_bridge/start_bridge.sh does.
+# MQTT_USER/MQTT_PASS are optional: the .13:1883 plane allows anonymous clients.
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+SECRETS_FILE="${SECRETS_FILE:-$HOME/.config/environment.d/10-secrets.conf}"
+if [[ -f "$SECRETS_FILE" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$SECRETS_FILE"
+  set +a
+fi
+
+exec docker compose up -d --build