feat(llm-proxy): in-cluster FastAPI shim with nginx pass-through

Closes the 'fork Pi coding agent' integration loop with a tiny
broker that mirrors the @earendil-works/pi-ai request shape:

  POST /internal/canvas-llm/chat
  body: { messages: [{role, content}], max_tokens }

The proxy speaks to OpenAI or Anthropic depending on which env key
is set. With no key, returns 503 so the frontend's deterministic
fallback in routeAgentInput fires gracefully.

- llm-proxy/main.py: FastAPI + httpx (~150 LOC). System messages get
  split out for Anthropic (separate 'system' field) and inlined for
  OpenAI.
- llm-proxy/Dockerfile: python:3.12-slim, uvicorn on :8080.
- Deployment + Service in demo namespace (verified Running).
- nginx.conf: /internal/canvas-llm/ proxies to the in-cluster service.

Provider keys are set to empty in the manifest by design: customer
flip is a single 'kubectl set env' or sealed-secret update.

nginx.conf

@@ -32,6 +32,17 @@ server {
     proxy_buffering off;
   }
 
+  # In-cluster LLM proxy. Returns 503 when no provider key is configured,
+  # so the frontend's deterministic fallback fires gracefully.
+  location /internal/canvas-llm/ {
+    proxy_pass http://canvas-llm-proxy.demo.svc.cluster.local:8080;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_http_version 1.1;
+    proxy_read_timeout 60s;
+    proxy_buffering off;
+  }
+
   # SPA fallback to index.html for client-side routing.
   location / {
     try_files $uri $uri/ /index.html;