Sync live code; move MQTT credentials out of source; untrack venv/

- mqtt_audio_bridge.py: MQTT_USER / MQTT_PASS are read from the environment,
  falling back to ~/.config/environment.d/10-secrets.conf (mode 600). The
  environment.d trap means a fresh SSH shell needs the file fallback.
- docker-compose.yml: pass MQTT_USER / MQTT_PASS through; keeps the live
  network_mode / Dockerfile topology.
- start_bridge.sh: launcher that sources the secrets file before compose up.
- app.py: commits the live initial_prompt that was uncommitted.
- .gitignore: add venv/ (was missing), __pycache__, *.bak*, *.wav.
- git rm -r --cached venv/: 13,413 tracked venv files removed from the index.

Credential note: MQTT_PASS was hardcoded in edaf914. origin/main was later
force-rewritten to redact it, but the value was exposed and must still be
rotated. Removing venv/ from the index does not shrink the repository: the
objects stay in history until a history rewrite and GC.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

start_bridge.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+#
+# start_bridge.sh — (re)start voice_bridge with MQTT credentials from the
+# environment, not from source.
+#
+# environment.d does NOT reach a fresh SSH shell (AGENTS.md section 4.4), so
+# this script sources the mode-600 secrets file itself. Only MQTT_USER and
+# MQTT_PASS are passed to the container; no secret values are written to git.
+#
+# Usage:
+#   ./start_bridge.sh            # rebuild if needed and (re)create voice_bridge
+#   ./start_bridge.sh --status   # show container state and recent logs
+#   ./start_bridge.sh --logs     # follow the bridge log
+#
+# Rollback: the previous image is kept as voice_bridge:pre-credential-hygiene.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SECRETS="${SECRETS_FILE:-$HOME/.config/environment.d/10-secrets.conf}"
+
+load_secrets() {
+    if [ -f "$SECRETS" ]; then
+        # shellcheck disable=SC1090
+        set -a; . "$SECRETS"; set +a
+    else
+        echo "start_bridge.sh: $SECRETS not found" >&2
+        exit 1
+    fi
+    if [ -z "${MQTT_USER:-}" ] || [ -z "${MQTT_PASS:-}" ]; then
+        echo "start_bridge.sh: MQTT_USER / MQTT_PASS missing from $SECRETS" >&2
+        exit 1
+    fi
+}
+
+case "${1:-}" in
+    --status)
+        docker ps --filter name=voice_bridge --format '{{.Names}}\t{{.Image}}\t{{.Status}}'
+        docker logs --tail 20 voice_bridge 2>&1 || true
+        exit 0
+        ;;
+    --logs)
+        exec docker logs -f voice_bridge
+        ;;
+    "")
+        load_secrets
+        exec docker compose -f "$HERE/docker-compose.yml" up -d --build voice-bridge
+        ;;
+    *)
+        echo "start_bridge.sh: unknown option $1" >&2
+        exit 2
+        ;;
+esac