Author LiteLLM AI proxy service (resolves #14)

Adds litellm + litellm-db to docker-compose.yml, litellm-config.yaml with
custom shadow-cost pricing (Claude Sonnet 5 reference, per #11) and a
priority-scheduling stub (per #16, needs real-hardware smoke test), and
required LITELLM_MASTER_KEY/SALT_KEY/DB_PASSWORD env vars. Untested on real
hardware — that's #17. Open WebUI/coding CLIs still talk to llama.cpp
directly, migration is #15.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -74,6 +74,38 @@ services:
     restart: unless-stopped
     networks: [ai-stack]
 
+  litellm:
+    image: ghcr.io/berriai/litellm:main-stable
+    container_name: litellm
+    depends_on:
+      - litellm-db
+      - llama-server
+    volumes:
+      - ./litellm-config.yaml:/app/config.yaml:ro
+    environment:
+      - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY:?set a real master key in .env — see docs/proxy-key-onboarding.md}
+      - LITELLM_SALT_KEY=${LITELLM_SALT_KEY:?set a real salt key in .env, do not change after first run}
+      - DATABASE_URL=postgresql://litellm:${LITELLM_DB_PASSWORD:-litellm}@litellm-db:5432/litellm
+    command: ["--config", "/app/config.yaml", "--port", "4000"]
+    ports:
+      # published for LAN access (proxy.ai.home) and, via NPM, proxy.ai.haylan.ch —
+      # NPM must deny the /ui path on the external host. See docs/network-access.md.
+      - "${LITELLM_PORT:-4000}:4000"
+    restart: unless-stopped
+    networks: [ai-stack]
+
+  litellm-db:
+    image: postgres:16-alpine
+    container_name: litellm-db
+    environment:
+      - POSTGRES_USER=litellm
+      - POSTGRES_PASSWORD=${LITELLM_DB_PASSWORD:-litellm}
+      - POSTGRES_DB=litellm
+    volumes:
+      - litellm-db-data:/var/lib/postgresql/data
+    restart: unless-stopped
+    networks: [ai-stack]
+
   lazytainer:
     image: ghcr.io/vmorganp/lazytainer:master
     container_name: lazytainer
@@ -91,3 +123,4 @@ volumes:
   models:
   qdrant-data:
   openwebui-data:
+  litellm-db-data: