feat(open-webui): add chat+image frontend, bypass omniroute for comfyui

OmniRoute's built-in comfyui provider hardcodes a CheckpointLoaderSimple
(single-file-checkpoint) workflow with no override (confirmed by
reading open-sse/handlers/imageGeneration/providers/comfyUI.ts
upstream), so it can't drive Qwen-Image 2.1's split unet/text-encoder/
vae GGUF loader chain. Open WebUI's own ComfyUI image backend is fully
generic instead — any exported workflow_api.json with arbitrary node
IDs mapped to parameters — so it can point straight at comfyui:8188.

Chat still goes through omniroute like every other client, via a
per-workload key (OPENWEBUI_OMNIROUTE_KEY, minted by hand same as
always). Published on host port 8008 per user request.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -126,6 +126,13 @@ COMFYUI_DIFFUSION_MODEL_FILE=qwen-image-2.1-UC-Q4_K_M.gguf
 COMFYUI_TEXT_ENCODER_FILE=qwen3vl_8b_int8_convrot.safetensors
 COMFYUI_VAE_FILE=qwen_image_2.1_vae_bf16.safetensors
 
+# --- Open WebUI (chat + ComfyUI image-gen frontend) ---
+# Chat backend goes through omniroute like every other client — mint this
+# key by hand in the omniroute dashboard per docs/proxy-key-onboarding.md
+# (label it openwebui-chat), no scripted mint yet. Image generation talks
+# to comfyui directly, no key needed there.
+OPENWEBUI_OMNIROUTE_KEY=
+
 # --- RAG databases (qdrant + neo4j, see wayfinder notes) ---
 # No auth on qdrant (its default) — same trust boundary as llama-server:
 # ai-stack is not exposed off-box. Random, filled in automatically: