AI-spel static asset service

Own only public, version-pinned Piper and ONNX speech assets.
Serve under /static/ on https://ai-spel.k3s.k0.nu.
VERSION is the only release version source. Use scripts/bump-version.py.
Gitea Actions on the existing large runner verifies, builds, and publishes. Never run tests, builds, containers, images, or binaries locally; do not create runners.
Git release commit/tag, image, Helm chart, and manifest use the same version.
Use Harbor project ai-spel, Argo CD project ai-spel, and Kubernetes namespace ai-spel.
/static/piper-wasm-v1/ is immutable and cached for one year. Incompatible asset updates require a new path and coordinated frontend change.
Publish /static/version.json with version generated from VERSION in the same image as the Helm appVersion; keep it uncached and verify its value after rollout. The frontend footer displays this release independently from frontend and API versions.
No secrets or runtime network access.