feat: US-001 - Setup venv-pockettts și pocket-tts.service systemd unit

- venv separat .venv-pockettts (torch + pocket-tts + keyring), gitignored
- tools/pocket_tts_env_launch.sh citește hf_token din keyring, exit non-zero + log clar dacă lipsește
- pocket-tts.service (systemd --user) pornește serverul built-in pe 127.0.0.1:7789 prin launcher
- gates: /review (manual, diff minimal) PASS, smoke test curl /health 200 + restart test PASS

tools/pocket_tts_env_launch.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Launcher for pocket-tts.service — resolves hf_token from keyring (needed to
+# download the gated kyutai/pocket-tts weights) and execs the server.
+set -uo pipefail
+
+REPO_ROOT="/home/moltbot/echo-core"
+VENV="$REPO_ROOT/.venv-pockettts"
+
+cd "$REPO_ROOT"
+
+HF_TOKEN="$(PYTHONPATH="$REPO_ROOT" "$VENV/bin/python3" -c "
+from src.credential_store import get_secret
+print(get_secret('hf_token') or '')
+")"
+
+if [ -z "$HF_TOKEN" ]; then
+    echo "[pocket-tts-launch] ERROR: hf_token lipsește din keyring (service echo-core). Setează-l cu: $REPO_ROOT/.venv/bin/python3 -c \"from src.credential_store import set_secret; set_secret('hf_token', '<token>')\"" >&2
+    exit 1
+fi
+
+export HF_TOKEN
+exec "$VENV/bin/pocket-tts" serve --host 127.0.0.1 --port 7789