feat: voice-agent MVP — LXC web frontend + Mac AI worker

LXC-Frontend (FastAPI + HTML/JS):
- Audio-Upload (MP3/WAV/M4A/MP4/OGG/FLAC, max. 500 MB)
- SQLite Job-Store, BackgroundTask-Pipeline
- Job-Liste mit Live-Status, Downloads (DOCX + JSON)
- Mac-Health-Indicator im UI

Mac-Worker (FastAPI):
- /api/transcribe (lightning-whisper-mlx | faster-whisper | mock)
- /api/summarize + /api/protocol via Ollama (llama3.1:8b)
- /api/export/docx via python-docx

Deploy:
- systemd-Service, Nginx Reverse-Proxy
- deploy/install.sh: idempotentes LXC-Setup

Doku: README.md, lxc-frontend/README.md, mac-worker/README.md

deploy/install.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Wird im LXC als deploy/root ausgeführt um die App einzurichten.
+# Idempotent: kann wiederholt laufen.
+set -euo pipefail
+
+REPO_URL="${REPO_URL:-https://git.cynfo.net/christian/voice-agent.git}"
+APP_DIR="/var/www/voice-agent"
+APP_USER="deploy"
+
+echo "[1/7] System-Pakete installieren"
+apt-get update -y
+apt-get install -y --no-install-recommends \
+  git python3 python3-venv python3-pip nginx ca-certificates curl ffmpeg
+
+echo "[2/7] Deploy-User sicherstellen"
+id "$APP_USER" >/dev/null 2>&1 || useradd -m -s /bin/bash "$APP_USER"
+mkdir -p "$APP_DIR"
+chown -R "$APP_USER:$APP_USER" "$APP_DIR"
+
+echo "[3/7] Repo klonen/aktualisieren"
+if [ -d "$APP_DIR/.git" ]; then
+  sudo -u "$APP_USER" git -C "$APP_DIR" fetch --all --prune
+  sudo -u "$APP_USER" git -C "$APP_DIR" reset --hard origin/main
+else
+  sudo -u "$APP_USER" git clone "$REPO_URL" "$APP_DIR"
+fi
+
+echo "[4/7] Python-venv + Dependencies"
+cd "$APP_DIR/lxc-frontend"
+sudo -u "$APP_USER" python3 -m venv .venv
+sudo -u "$APP_USER" .venv/bin/pip install --upgrade pip
+sudo -u "$APP_USER" .venv/bin/pip install -r requirements.txt
+
+echo "[5/7] .env anlegen falls fehlt"
+if [ ! -f "$APP_DIR/lxc-frontend/.env" ]; then
+  cp "$APP_DIR/lxc-frontend/.env.example" "$APP_DIR/lxc-frontend/.env"
+  chown "$APP_USER:$APP_USER" "$APP_DIR/lxc-frontend/.env"
+fi
+
+mkdir -p /var/lib/voice-agent/uploads /var/lib/voice-agent/results
+chown -R "$APP_USER:$APP_USER" /var/lib/voice-agent
+
+echo "[6/7] systemd-Service installieren"
+cp "$APP_DIR/deploy/systemd/voice-agent.service" /etc/systemd/system/voice-agent.service
+systemctl daemon-reload
+systemctl enable voice-agent
+systemctl restart voice-agent
+
+echo "[7/7] Nginx-Reverse-Proxy"
+cp "$APP_DIR/deploy/nginx/voice-agent.conf" /etc/nginx/sites-available/voice-agent
+ln -sf /etc/nginx/sites-available/voice-agent /etc/nginx/sites-enabled/voice-agent
+rm -f /etc/nginx/sites-enabled/default
+nginx -t
+systemctl reload nginx
+
+echo
+echo "Fertig. Health-Check:"
+echo "  curl -s http://localhost/health"
+echo
+echo "Nach erstem Start unbedingt MAC_API_URL in $APP_DIR/lxc-frontend/.env setzen und Service neu starten:"
+echo "  sudo systemctl restart voice-agent"

deploy/nginx/voice-agent.conf

@@ -0,0 +1,20 @@
+server {
+    listen 80 default_server;
+    server_name _;
+
+    # Upload-Limit muss zu MAX_UPLOAD_MB in .env passen
+    client_max_body_size 600M;
+
+    # Lange Verarbeitung — Timeouts hoch
+    proxy_read_timeout 1800;
+    proxy_send_timeout 1800;
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

deploy/systemd/voice-agent.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=Voice-Agent FastAPI (LXC-Frontend)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=deploy
+Group=deploy
+WorkingDirectory=/var/www/voice-agent/lxc-frontend
+EnvironmentFile=/var/www/voice-agent/lxc-frontend/.env
+ExecStart=/var/www/voice-agent/lxc-frontend/.venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 2
+Restart=on-failure
+RestartSec=3
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target