[Sync] replace the flat layout with the unified stow tree

Supersedes the old flat .config/ layout (last published 2026-06-28) with the
private repo's structure: one shared base plus per-host overlays.

- packages: common/ gui/ lw/ fl/ wm/ plus install.sh and bin/ tooling
  (dotsync, reconcile-hyde.sh)
- new README covering the layout, deploy order and the HyDE dependency
- current HyDE waybar rig (layouts/, cava), pi agent extensions, claude/
  config, tmux, presenterm, aichat roles
- fish: kp (keepassxc-cli + fzf picker, db path from $KP_DB) and
  bind_M_n_history (alt+1..9 recalls the nth history entry)
- drops cruft that should never have been tracked: the duplicate top-level
  .pi/ copy, btop.log, zellij config.kdl.bak, fish_variables
- .pi/agent/auth.json is gitignored; auth.json.example ships instead

Host-specific work sessions and the personal backlog stay in the private
tree. Endpoint locators in the llamacpp/whisper guides are placeholders
($SERVER, <own-domain>) — the guides themselves stay, since they are the
useful part.

fl/.config/whisper/whisper@.service

@@ -0,0 +1,48 @@
+[Unit]
+Description=whisper.cpp STT server "%i" (CPU-only) — OpenAI-compatible /v1/audio/transcriptions
+Documentation=file:///home/anon/.config/whisper/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=anon
+Group=anon
+WorkingDirectory=/
+# TEMPLATE UNIT — one file, N instances. `systemctl start whisper@small` reads its model/port/language
+# from ~/.config/whisper/small.env. Deliberately not N copies of this unit: the --tmp-dir bug below had
+# to be found once and fixed once, and that only holds if there is exactly one ExecStart in the repo.
+EnvironmentFile=/home/anon/.config/whisper/%i.env
+# whisper-server's --tmp-dir defaults to "." — with WorkingDirectory=/ that means it tries to write
+# uploads and ffmpeg output into the filesystem root, and every request dies with
+#   {"error":"FFmpeg conversion failed."}   (yes, even plain wav: --convert pipes everything to ffmpeg)
+# RuntimeDirectory= creates /run/whisper-<instance>, owned by this user, wiped on stop. Per-instance so
+# two servers can never collide on a temp filename.
+RuntimeDirectory=whisper-%i
+RuntimeDirectoryMode=0700
+#
+# ⚠⚠ --no-gpu IS LOAD-BEARING. The GPU on this box drives the display AND holds a 13-15 GB chat model;
+#    ROCm does not OOM cleanly, it spills to GTT and freezes the whole PC. Whisper is CPU-only BY
+#    DESIGN (same rule as the Qwen3-Embedding preset): 0 VRAM means it can never stack into an
+#    overcommit, and it never evicts / gets evicted by the router. Do not remove.
+# --convert shells out to ffmpeg (webm/opus/ogg -> 16 kHz wav). This is the whole reason the Open WebUI
+#    mic button works — the browser records opus, whisper.cpp reads wav.
+# --inference-path puts the route exactly where OWUI posts (--request-path defaults to empty), so a
+#    client's base URL is http://192.168.0.204:<port>/v1 .
+ExecStart=/usr/bin/whisper-server \
+  --model ${WHISPER_MODEL} \
+  --host 0.0.0.0 --port ${WHISPER_PORT} \
+  --inference-path /v1/audio/transcriptions \
+  --convert \
+  --tmp-dir /run/whisper-%i \
+  --no-gpu \
+  --threads 6 \
+  --language ${WHISPER_LANG}
+Restart=always
+RestartSec=2
+# Yield to the llama.cpp router: its CPU-offloaded MoE experts (n-cpu-moe) want the same 6 cores.
+Nice=5
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target