Migrate Open WebUI and coding CLIs to the AI proxy (resolves #15)

Open WebUI now points at litellm instead of llama-server directly, using a
provisioned virtual key. llama-server's host port is dropped (internal-only
on the ai-stack network) since the proxy is the only intended entry point
now. docs/coding-cli-setup.md repointed at the proxy's endpoints/ports with
per-CLI virtual keys instead of the old shared dummy key.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -20,10 +20,11 @@ services:
       --n-gpu-layers ${LLAMA_GPU_LAYERS:-999}
       --ctx-size ${LLAMA_CTX_SIZE:-65536}
       --jinja
-    ports:
-      # published to the host so Claude Code CLI / Kimi CLI can reach it directly,
-      # bypassing Open WebUI.
-      - "${LLAMA_PORT:-8080}:8080"
+    # No published host port: llama-server is reached only via the litellm
+    # proxy on the ai-stack docker network now — see issue #15. Its
+    # unauthenticated API no longer needs to be LAN-reachable directly.
+    expose:
+      - "8080"
     restart: unless-stopped
     networks: [ai-stack]
     labels:
@@ -61,12 +62,16 @@ services:
     container_name: open-webui
     depends_on:
       - qdrant
+      - litellm
     volumes:
       - openwebui-data:/app/backend/data
     environment:
       - WEBUI_AUTH=True
-      - OPENAI_API_BASE_URL=http://llama-server:8080/v1
-      - OPENAI_API_KEY=${OPENAI_API_KEY:-local}
+      # Routed through the litellm proxy, not llama-server directly — see issue #15.
+      # OPENAI_API_KEY must be a virtual key created for Open WebUI per
+      # docs/proxy-key-onboarding.md (name it "openwebui"), set in .env.
+      - OPENAI_API_BASE_URL=http://litellm:4000/v1
+      - OPENAI_API_KEY=${OPENWEBUI_LITELLM_KEY:?set to the openwebui virtual key from LiteLLM's Admin UI}
       - VECTOR_DB=qdrant
       - QDRANT_URI=http://qdrant:6333
     ports: