fix(omniroute): keep the gateway published on host port 4000

Not omniroute's own internal port (API_PORT stays at its default 20129,
unreconfigured) - just the Docker port mapping, so existing NPM/firewall
config pointed at :4000 keeps working without changes on that end. New
OMNIROUTE_PORT env var is the host side of "OMNIROUTE_PORT:API_PORT" in
docker-compose.yml's ports: entry.

Also corrected docs/proxy-key-onboarding.md's dashboard-access
instructions - DASHBOARD_PORT was never published to the host in the
first place, so "http://<host>:20128" was never actually reachable as
written; documented reaching it via the container's own bridge-network IP
or an SSH port-forward instead.

llama-server remains unexposed (no ports: entry, only expose:) -
unaffected by this change, confirming it stays that way.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VPZ6TogJiYxG8E4EQBB197

docker-compose.yml

@@ -72,9 +72,10 @@ services:
     env_file: .env
     environment:
       # Split-port mode: dashboard and API are fully separate ports (unlike
-      # LiteLLM's single :4000 for both /v1 and /ui) — only API_PORT is
-      # published below, so the dashboard has no network route in from
-      # outside this container at all. No NPM path-deny rule needed.
+      # LiteLLM's single :4000 for both /v1 and /ui) — only API_PORT (via
+      # the OMNIROUTE_PORT:4000 host mapping below) is published, so the
+      # dashboard has no network route in from outside this container at
+      # all. No NPM path-deny rule needed.
       - API_HOST=0.0.0.0
       - API_PORT=${OMNIROUTE_API_PORT:-20129}
       - DASHBOARD_PORT=${OMNIROUTE_DASHBOARD_PORT:-20128}
@@ -87,8 +88,13 @@ services:
     # network can't resolve search.home on its own.
     extra_hosts:
       - "search.home:${SEARXNG_LAN_IP}"
+    # OMNIROUTE_PORT (host) is decoupled from API_PORT (container-internal,
+    # left at omniroute's own default) via plain Docker port mapping — the
+    # gateway needs to stay reachable at the same :4000 this stack has
+    # always published (NPM/firewall already point there), without having
+    # to also change omniroute's own internal port config to match.
     ports:
-      - "${OMNIROUTE_API_PORT:-20129}:${OMNIROUTE_API_PORT:-20129}"
+      - "${OMNIROUTE_PORT:-4000}:${OMNIROUTE_API_PORT:-20129}"
     restart: unless-stopped
     networks: [ai-stack]
     # ponytail: TCP-connect check, not an HTTP /healthz GET — the image has