deploy/mainnet: add PiperTTS (private) + supplier-tts (audio.synthesize.piper.v1)

Mirrors deploy/testnet/docker-compose.supplier-tts.yml and the simulation
PiperTTS stack, co-located on vector-marketplace as a private internal
service on marketplace-mainnet-net (no Traefik labels, no public DNS for
Piper itself). Supplier reaches Piper at http://marketplace-mainnet-tts-piper:8000.
Voice: en_US-lessac-high. New supplier wallet + on-chain advert are
published out-of-band by the operator per the runbook header.

Files:
- deploy/mainnet/docker-compose.tts-piper.yml         openedai-speech-min, private
- deploy/mainnet/docker-compose.supplier-tts.yml      CAPABILITY_KIND=tts supplier
- deploy/mainnet/install-voice-extras.sh              voice download + yaml mapping
- deploy/mainnet/voice-mappings.py                    idempotent yaml editor
- supplier/.env.tts.example                           operator env template
- .gitignore                                          whitelist .env.*.example

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

supplier/.env.tts.example

@@ -0,0 +1,85 @@
+# supplier/.env.tts.example — TTS supplier (audio.synthesize.piper.v1) — MAINNET
+#
+# Copy to supplier/.env.tts on the vector-marketplace host (chmod 600),
+# fill secrets, then follow the runbook in deploy/mainnet/docker-compose.supplier-tts.yml
+# header. .env.tts is gitignored — NEVER commit a populated copy.
+#
+# To generate a fresh Ed25519 wallet:
+#   docker compose -f deploy/mainnet/docker-compose.supplier-tts.yml run --rm \
+#     --entrypoint sh supplier \
+#     -c "node_modules/.bin/tsx supplier/src/cli/gen-keypair.ts --network 1"
+# Fund the printed addr1... with ~5 AP3X mainnet via the Vector faucet/exchange,
+# THEN paste the privateKeyHex below.
+
+# ─── Required ─────────────────────────────────────────────────────────────
+
+# 64-char hex Ed25519 private key seed for the TTS supplier wallet. SECRET.
+SUPPLIER_PRIV_KEY_HEX=PASTE_64_HEX_CHARS_HERE
+
+# Cardano network ID. "1" = mainnet. Do NOT change this on the mainnet host.
+NETWORK_ID=1
+
+# Public Vector mainnet Ogmios. HTTPS for builders/queries; the supplier
+# uses HTTP fetch (no WebSocket), so wss:// silently errors with
+# "unknown scheme".
+OGMIOS_URL=https://ogmios.vector.mainnet.apexfusion.org
+
+# Vector mainnet genesis time (ms). lucid-evolution's slot-config reads
+# this at module load — see packages/shared/src/tx/internal/lucidContext.ts
+# header for the historical footgun.
+VECTOR_ZERO_TIME_MS=1756485600000
+
+# Shared mainnet CIP-33 reference scripts (published once; reused across all
+# mainnet suppliers/buyers).
+ESCROW_REF_UTXO=c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#0
+ADVERT_REF_UTXO=c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#1
+
+# Opt in to real Ogmios submitTx/awaitTx. Any value other than literal "1"
+# leaves the supplier in ReadOnly mode (safety net).
+LIVE_CHAIN=1
+
+# OutputReference of THIS supplier's on-chain advertisement UTxO.
+# Filled in AFTER running supplier/src/cli/post-advert.ts (see runbook step i).
+# Format: "<64-hex-tx-hash>#<int-output-index>"
+ADVERT_REF=PASTE_TXHASH_HERE#0
+
+# ─── Advert content (read by post-advert.ts; also stored on-chain) ────────
+
+# Capability published in the advertisement. Buyers filter on this string
+# when picking a TTS supplier.
+ADVERT_CAPABILITY_ID=audio.synthesize.piper.v1
+
+# Informational model label. The actual voice is selected per-request in
+# the body (`voice: lessac` etc.); this string just helps buyers identify
+# the supplier in dashboards/UIs.
+ADVERT_MODEL=piper-en_US-lessac-high
+
+# Token budget — metadata-only for TTS. The runtime always reports 0 tokens
+# in receipts (see supplier/src/jobRunner.ts `runTtsJob`). Verify against
+# the live testnet TTS advert before publishing if you want strict parity:
+#   curl https://mp-indexer.vector.testnet.apexfusion.org/suppliers \
+#     | jq '.[] | select(.capability_id=="audio.synthesize.piper.v1") | .max_output_tokens'
+ADVERT_MAX_OUTPUT_TOKENS=0
+
+# Maximum processing time the supplier guarantees per synthesis (ms).
+ADVERT_MAX_PROCESSING_MS=60000
+
+# Flat price per synthesis in AP3X lovelace.
+ADVERT_PRICE_LOVELACE=2000000
+
+# Supplier bond locked into the advert UTxO (lovelace).
+ADVERT_SUPPLIER_BOND_LOVELACE=1000000
+
+# Buyer bond required per escrow (lovelace).
+ADVERT_BUYER_BOND_LOVELACE=1000000
+
+# HTTPS endpoint buyers will call. Must match the Traefik Host rule in
+# deploy/mainnet/docker-compose.supplier-tts.yml.
+ADVERT_ENDPOINT_URL=https://mp-suppliers-tts.vector.apexfusion.org
+
+# Optional off-chain detail pointer (IPFS / HTTPS URI). Leave empty for v1.
+ADVERT_DETAIL_URI=
+
+# Optional sha256 of the detail JSON (64 hex chars). If empty, defaults to
+# sha256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
+ADVERT_DETAIL_HASH=