feat: add Cloudflare AI TTS engine (aura-2-en) with voice grouping in UI

homelab/runner/docker-compose.yml

@@ -13,6 +13,11 @@
 #   - RUNNER_SKIP_INITIAL_CATALOGUE_REFRESH=true
 #   - REDIS_ADDR              → rediss://redis.libnovel.cc:6380 (prod Redis via Caddy TLS proxy)
 #   - LibreTranslate service for machine translation (internal network only)
+#
+# extra_hosts pins storage.libnovel.cc and pb.libnovel.cc to the prod server IP
+# (165.22.70.138) so that large PutObject uploads and PocketBase writes bypass
+# Cloudflare's 100-second proxy timeout entirely. TLS still terminates at Caddy
+# on prod; the TLS certificate is valid for the domain names so SNI works fine.
 
 services:
   libretranslate:
@@ -35,6 +40,12 @@ services:
     stop_grace_period: 135s
     depends_on:
       - libretranslate
+    # Pin prod subdomains to the prod server IP to bypass Cloudflare's 100s
+    # proxy timeout. Large MP3 PutObject uploads and PocketBase writes go
+    # directly to Caddy on prod; TLS and SNI still work normally.
+    extra_hosts:
+      - "storage.libnovel.cc:165.22.70.138"
+      - "pb.libnovel.cc:165.22.70.138"
     environment:
       # ── PocketBase ──────────────────────────────────────────────────────────
       POCKETBASE_URL: "https://pb.libnovel.cc"
@@ -63,6 +74,10 @@ services:
       # ── Pocket TTS ──────────────────────────────────────────────────────────
       POCKET_TTS_URL: "${POCKET_TTS_URL}"
 
+      # ── Cloudflare Workers AI TTS ────────────────────────────────────────────
+      CFAI_ACCOUNT_ID: "${CFAI_ACCOUNT_ID}"
+      CFAI_API_TOKEN: "${CFAI_API_TOKEN}"
+
       # ── LibreTranslate (internal Docker network) ────────────────────────────
       LIBRETRANSLATE_URL: "http://libretranslate:5000"
       LIBRETRANSLATE_API_KEY: "${LIBRETRANSLATE_API_KEY}"