feat(knowledgebase): replace litellm-pgvector connector with memory-retrieval

Per docs/research/langchain-pgvector-vs-litellm-pgvector.md (issue #25):
the vendored litellm-pgvector connector (793 lines, Prisma migrations, a
fragile git-context build) is replaced by a ~90-line FastAPI service
(services/memory-retrieval/) wrapping langchain_postgres.PGVector directly
against pgvector-db. Same gateway boundary — it still calls litellm for
embeddings, nothing talks to Postgres or the model directly except this
service.

- New services/memory-retrieval/ (main.py, Dockerfile, requirements.txt):
  POST /ingest, POST /query, GET /health.
- docker-compose.yml: litellm-pgvector service replaced by memory-retrieval;
  pgvector-db and embedding-server untouched.
- litellm-config.yaml: vector_store_registry block removed (no
  langchain_postgres provider exists to register against; callers query
  memory-retrieval directly instead of an in-band file_search tool call —
  that mechanism was never confirmed working per issue #24 anyway).
- scripts/ingest-memory.sh rewritten for the new /ingest endpoint (same
  per-line chunking, no dedup).
- .env vars renamed: LITELLM_PGVECTOR_API_KEY/LITELLM_PGVECTOR_EMBEDDING_KEY
  -> MEMORY_RETRIEVAL_API_KEY/MEMORY_RETRIEVAL_EMBEDDING_KEY.
- vendor/litellm-pgvector/ removed entirely.
- docs/memory-knowledgebase.md updated for the new setup/query flow.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/generate-secrets.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Generates random values for the secrets docker-compose.yml requires
 # (LITELLM_MASTER_KEY, LITELLM_SALT_KEY, LITELLM_DB_PASSWORD, UI_PASSWORD,
-# PGVECTOR_DB_PASSWORD, LITELLM_PGVECTOR_API_KEY) and writes them into .env —
+# PGVECTOR_DB_PASSWORD, MEMORY_RETRIEVAL_API_KEY) and writes them into .env —
 # creating it from .env.example first if it doesn't exist.
 #
 # ponytail: only fills in blank values, never overwrites ones you've already
@@ -27,6 +27,6 @@ set_if_blank LITELLM_SALT_KEY "$(openssl rand -hex 32)"
 set_if_blank LITELLM_DB_PASSWORD "$(openssl rand -hex 32)"
 set_if_blank UI_PASSWORD "$(openssl rand -hex 16)"
 set_if_blank PGVECTOR_DB_PASSWORD "$(openssl rand -hex 32)"
-set_if_blank LITELLM_PGVECTOR_API_KEY "$(openssl rand -hex 32)"
+set_if_blank MEMORY_RETRIEVAL_API_KEY "$(openssl rand -hex 32)"
 
-echo "Done. Review .env, then set OPENWEBUI_LITELLM_KEY, LITELLM_PGVECTOR_EMBEDDING_KEY, and SEARXNG_LAN_IP per docs/proxy-key-onboarding.md and docs/memory-knowledgebase.md."
+echo "Done. Review .env, then set OPENWEBUI_LITELLM_KEY, MEMORY_RETRIEVAL_EMBEDDING_KEY, and SEARXNG_LAN_IP per docs/proxy-key-onboarding.md and docs/memory-knowledgebase.md."

scripts/ingest-memory.sh

@@ -1,48 +1,37 @@
 #!/usr/bin/env bash
-# Loads data/memory.md and data/claude-legacy-memory.md into the LiteLLM
-# knowledgebase (the "memory-and-notes" vector store, see litellm-config.yaml)
-# via litellm-pgvector's batch-embeddings endpoint.
+# Loads data/memory.md and data/claude-legacy-memory.md into the
+# memory-retrieval knowledgebase (POST /ingest).
 #
 # ponytail: one chunk per non-empty, non-heading line — both source files are
 # already one fact/paragraph per line (no hard-wrapping), so this needs no
-# real chunking logic. Re-run after editing either file; there's no dedup, so
-# this appends duplicates on a second run against unchanged content — clear
-# the store first (DELETE the vector_store_id's rows) if you need a clean
+# real chunking logic. Re-run after editing either file; there's no dedup,
+# PGVector always inserts — clear the collection first if you need a clean
 # reload.
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
 [ -f .env ] && set -a && . ./.env && set +a
 
-: "${LITELLM_PGVECTOR_API_KEY:?Set LITELLM_PGVECTOR_API_KEY in .env first}"
-LITELLM_PGVECTOR_URL="${LITELLM_PGVECTOR_URL:-http://localhost:8000}"
-VECTOR_STORE_ID="memory-and-notes"
-
-# Must match litellm-config.yaml's vector_store_registry entry — the
-# registry just points at a store the backend must already know about.
-# Ignores failure if it already exists (no documented idempotency check).
-curl -sf -X POST "${LITELLM_PGVECTOR_URL}/v1/vector_stores" \
-  -H "Authorization: Bearer ${LITELLM_PGVECTOR_API_KEY}" \
-  -H "Content-Type: application/json" \
-  -d "{\"name\": \"${VECTOR_STORE_ID}\"}" > /dev/null 2>&1 || true
+: "${MEMORY_RETRIEVAL_API_KEY:?Set MEMORY_RETRIEVAL_API_KEY in .env first}"
+MEMORY_RETRIEVAL_URL="${MEMORY_RETRIEVAL_URL:-http://localhost:8000}"
 
 ingest_file() {
   local file="$1" section=""
-  local batch="[]"
+  local chunks="[]"
   while IFS= read -r line; do
     case "$line" in
       "#"*) section="${line#\# }"; section="${section#\#\# }"; continue ;;
       ""|"---") continue ;;
     esac
-    batch=$(jq --arg content "$line" --arg source "$file" --arg section "$section" \
-      '. += [{"content": $content, "metadata": {"source": $source, "section": $section}}]' <<<"$batch")
+    chunks=$(jq --arg content "$line" --arg source "$file" --arg section "$section" \
+      '. += [{"content": $content, "metadata": {"source": $source, "section": $section}}]' <<<"$chunks")
   done < "$file"
 
-  echo "Ingesting $(jq 'length' <<<"$batch") chunks from $file..."
-  curl -sf -X POST "${LITELLM_PGVECTOR_URL}/v1/vector_stores/${VECTOR_STORE_ID}/embeddings/batch" \
-    -H "Authorization: Bearer ${LITELLM_PGVECTOR_API_KEY}" \
+  echo "Ingesting $(jq 'length' <<<"$chunks") chunks from $file..."
+  curl -sf -X POST "${MEMORY_RETRIEVAL_URL}/ingest" \
+    -H "Authorization: Bearer ${MEMORY_RETRIEVAL_API_KEY}" \
     -H "Content-Type: application/json" \
-    -d "$batch" > /dev/null
+    -d "{\"chunks\": ${chunks}}" > /dev/null
 }
 
 ingest_file data/memory.md