Sync live code; move MQTT credentials out of source; untrack venv/

- mqtt_audio_bridge.py: MQTT_USER / MQTT_PASS are read from the environment,
  falling back to ~/.config/environment.d/10-secrets.conf (mode 600). The
  environment.d trap means a fresh SSH shell needs the file fallback.
- docker-compose.yml: pass MQTT_USER / MQTT_PASS through; keeps the live
  network_mode / Dockerfile topology.
- start_bridge.sh: launcher that sources the secrets file before compose up.
- app.py: commits the live initial_prompt that was uncommitted.
- .gitignore: add venv/ (was missing), __pycache__, *.bak*, *.wav.
- git rm -r --cached venv/: 13,413 tracked venv files removed from the index.

Credential note: MQTT_PASS was hardcoded in edaf914. origin/main was later
force-rewritten to redact it, but the value was exposed and must still be
rotated. Removing venv/ from the index does not shrink the repository: the
objects stay in history until a history rewrite and GC.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docker-compose.yml

@@ -1,31 +1,34 @@
 services:
   whisper-api:
-    image: python:3.9-slim
+    build: .
     container_name: voice_whisper
     restart: unless-stopped
     working_dir: /app
     volumes:
       - ./app.py:/app/app.py
-    command: >
-      sh -c "pip install flask faster-whisper && python app.py"
+    command: python app.py
     ports:
       - "5000:5000"
+
   voice-bridge:
-    image: python:3.9-slim
+    build:
+      context: .
+      dockerfile: Dockerfile.bridge
+    image: voice_bridge:local
     container_name: voice_bridge
     restart: unless-stopped
+    network_mode: "host"
     deploy:
       resources:
         limits:
           memory: 500M
     depends_on:
       - whisper-api
-    working_dir: /app
-    volumes:
-      - ./mqtt_audio_bridge.py:/app/mqtt_audio_bridge.py
     environment:
       - XDG_CACHE_HOME=/root/.cache
-    command: >
-      sh -c "pip install paho-mqtt requests 'numpy<2' openwakeword tflite-runtime && 
-             python -c 'import openwakeword; openwakeword.utils.download_models()' && 
-             python mqtt_audio_bridge.py"
+      # Passed through from the invoking shell. start_bridge.sh sources
+      # ~/.config/environment.d/10-secrets.conf first, because environment.d
+      # does not reach a fresh SSH shell (AGENTS.md section 4.4).
+      # No secret values live in this file or in git.
+      - MQTT_USER
+      - MQTT_PASS