feat(docker): add Windows WSL2 Docker Desktop support

[Gabriel-Ciriaco]

Summary

Adds Windows Docker Desktop (WSL2) support to VectorIntelligence while maintaining compatibility with native Linux, native Windows, and Linux Docker deployments.

Resolves mDNS multicast bridging under WSL2, fixes gRPC voice stream routing for Vector OS 2.0.1 firmware, adds configurable Whisper model support, and enforces local loopback binding across services.

Changes

1. Native Windows mDNS Reflector (shared/mdns-reflector.go)

• Docker Desktop on Windows (WSL2) operates behind a virtual network bridge that drops incoming UDP mDNS multicast queries (224.0.0.251:5353).
• Added a cross-compiled Go binary (windows-mdns.exe) built during Docker image creation.
• On container startup, docker-entrypoint.sh exports windows-mdns.exe to ./vector-data/. Running this binary on the Windows host advertises escapepod.local -> LAN IP directly to Vector.
• Container-level mDNS is suppressed via DISABLE_SUPERVISOR_MDNS=true to prevent container-internal 172.x IPs from conflicting with host LAN resolution.

2. Vector OS 2.0.1 Firmware Compatibility (Port 8084)

• Vector OS 2.0.1 firmware streams gRPC voice requests over port 8084 instead of port 443.
• Patched chipper/pkg/initwirepod/startserver.go in Dockerfile to enable both port 443 (OS 1.8) and port 8084 (OS 2.0.1) simultaneously with custom TLS certificates.

3. TLS Certificate Paths and Default Config

• Fixed relative certificate path resolution (../certs/cert.key) in docker-entrypoint.sh by symlinking /root/vector-pod/wire-pod/certs and /root/vector-pod/wire-pod/chipper/certs to /user-data/certs.
• Updated shared/config/wirepod-apiConfig.json defaults (whisper.cpp, epconfig: false, pastinitialsetup: true) for first-run container initialization.

4. Configurable Whisper Model

• Added ARG WHISPER_MODEL="base.en" in Dockerfile and docker-compose.yml.
• Allows switching model size (e.g., tiny.en, base.en, small.en, medium.en) using WHISPER_MODEL=small.en docker compose build --no-cache.

5. Security and Network Scoping

• Bound vector-ai uvicorn service to 127.0.0.1 loopback in supervisor.py to prevent direct external access to port 8090.
• Added optional firewall rule cleanup script under shared/scripts/remove-windows-mdns-rule.ps1.

Documentation

• Updated README.md with Windows Docker Desktop setup steps, WSL2 networkingMode=mirrored requirements, session-certs transfer notes from native Wire-Pod, optional firewall cleanup steps, Linux network_mode: "host" mDNS usage, and WHISPER_MODEL customization.

Testing

• Tested on Windows 11 Pro with Docker Desktop (WSL2 Mirrored Mode) on WireOS 3.0.1.32d.
• Verified voice recognition, Whisper transcription, Gemma 4 LLM responses, and robot audio/animation playback.
• Verified fresh --no-cache Docker builds and container restarts.