feat(llm-proxy): in-cluster FastAPI shim with nginx pass-through

Closes the 'fork Pi coding agent' integration loop with a tiny
broker that mirrors the @earendil-works/pi-ai request shape:

  POST /internal/canvas-llm/chat
  body: { messages: [{role, content}], max_tokens }

The proxy speaks to OpenAI or Anthropic depending on which env key
is set. With no key, returns 503 so the frontend's deterministic
fallback in routeAgentInput fires gracefully.

- llm-proxy/main.py: FastAPI + httpx (~150 LOC). System messages get
  split out for Anthropic (separate 'system' field) and inlined for
  OpenAI.
- llm-proxy/Dockerfile: python:3.12-slim, uvicorn on :8080.
- Deployment + Service in demo namespace (verified Running).
- nginx.conf: /internal/canvas-llm/ proxies to the in-cluster service.

Provider keys are set to empty in the manifest by design: customer
flip is a single 'kubectl set env' or sealed-secret update.

qa/audit_documents.mjs

@@ -0,0 +1,23 @@
+import { chromium } from "playwright";
+const args = ["--host-resolver-rules=MAP canvas.flow-master.ai 65.21.71.186", "--ignore-certificate-errors"];
+const b = await chromium.launch({ headless: true, args });
+const p = await (await b.newContext({ viewport: { width: 1440, height: 900 } })).newPage();
+await p.goto("https://canvas.flow-master.ai/", { waitUntil: "networkidle" });
+await p.waitForTimeout(800);
+await p.locator(".persona-chip", { hasText: /Mariana/ }).click();
+await p.locator(".dev-login-btn").click();
+await p.waitForSelector(".hero-actions", { timeout: 15000 });
+await p.locator(".hub-chip", { hasText: /^Documents$/ }).click();
+await p.waitForSelector(".docs-row", { timeout: 20000 }).catch(() => {});
+await p.waitForTimeout(2000);
+const rows = await p.locator(".docs-row").count();
+const headers = await p.locator(".docs-row-title").allTextContents();
+console.log(`rows: ${rows}`);
+console.log(`first 5: ${headers.slice(0, 5).join(" | ")}`);
+if (rows > 0) {
+  await p.locator(".docs-row").first().click();
+  await p.waitForTimeout(800);
+  const detailTitle = await p.locator(".docs-card-title").textContent();
+  console.log(`detail title: ${detailTitle}`);
+}
+await b.close();