Add shared ai-service container as AI provider intermediary

All feature containers now POST messages to ai-service (port 8010) instead
of calling AI providers directly. ai-service routes to LM Studio, Ollama,
or Anthropic based on /config/ai_service_config.json. doc-service AI
providers removed; replaced by httpx ai_client.py. Backend settings
restructured to /api/settings/ai. Frontend gets dedicated AIAdminSettingsPage
and AI Service card in AppsPage.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/core/app_config.py

@@ -2,21 +2,21 @@
 Per-service runtime config helpers.
 
 Config files live on the shared `app_config` Docker volume at /config/.
-Each service has its own JSON file, e.g. /config/doc_service_config.json.
+Each service has its own JSON file.
 
 Atomic write pattern: write to .tmp in same dir, then os.replace() so
-doc-service never reads a partial file.
+services never read a partial file.
 """
+import copy
 import json
 import os
 from pathlib import Path
-from typing import Any
 
 from pydantic import BaseModel
 
 _CONFIG_DIR = Path(os.environ.get("APP_CONFIG_DIR", "/config"))
 
-# ── Config schemas ─────────────────────────────────────────────────────────────
+# ── AI service config schemas ──────────────────────────────────────────────────
 
 
 class AnthropicConfig(BaseModel):
@@ -25,32 +25,34 @@ class AnthropicConfig(BaseModel):
 
 
 class OllamaConfig(BaseModel):
-    base_url: str = "http://192.168.1.x:11434/v1"
+    base_url: str = "http://host.docker.internal:11434/v1"
     model: str = "llama3.2"
     api_key: str = "ollama"
 
 
 class LMStudioConfig(BaseModel):
-    # host.docker.internal resolves to the host from inside Docker (macOS/Windows).
-    # For local dev outside Docker, use http://localhost:1234/v1 instead.
     base_url: str = "http://host.docker.internal:1234/v1"
     model: str = "local-model"
     api_key: str = "lm-studio"
 
 
-class AIConfig(BaseModel):
+class AIServiceConfig(BaseModel):
     provider: str = "lmstudio"
+    timeout_seconds: int = 60
+    max_retries: int = 2
     anthropic: AnthropicConfig = AnthropicConfig()
     ollama: OllamaConfig = OllamaConfig()
     lmstudio: LMStudioConfig = LMStudioConfig()
 
 
+# ── Doc service config schemas ─────────────────────────────────────────────────
+
+
 class DocumentsConfig(BaseModel):
     max_pdf_bytes: int = 20 * 1024 * 1024
 
 
 class DocServiceConfig(BaseModel):
-    ai: AIConfig = AIConfig()
     documents: DocumentsConfig = DocumentsConfig()
 
 
@@ -62,14 +64,11 @@ def _mask_key(key: str) -> str:
     return key[:7] + "••••"
 
 
-def _mask_config(data: dict) -> dict:
-    """Return a copy of data with api_key fields masked."""
-    import copy
+def _mask_ai_config(data: dict) -> dict:
     masked = copy.deepcopy(data)
-    ai = masked.get("ai", {})
     for provider in ("anthropic", "ollama", "lmstudio"):
-        if provider in ai and "api_key" in ai[provider]:
-            ai[provider]["api_key"] = _mask_key(ai[provider]["api_key"])
+        if provider in masked and "api_key" in masked[provider]:
+            masked[provider]["api_key"] = _mask_key(masked[provider]["api_key"])
     return masked
 
 
@@ -82,7 +81,8 @@ def _config_path(service: str) -> Path:
 def load_service_config(service: str) -> dict:
     path = _config_path(service)
     if not path.exists():
-        # Return default config if file doesn't exist yet
+        if service == "ai_service":
+            return AIServiceConfig().model_dump()
         if service == "doc_service":
             return DocServiceConfig().model_dump()
         return {}
@@ -98,6 +98,24 @@ def save_service_config(service: str, data: dict) -> None:
     os.replace(tmp, path)
 
 
+# AI service helpers
+
+def load_ai_service_config() -> AIServiceConfig:
+    raw = load_service_config("ai_service")
+    return AIServiceConfig.model_validate(raw)
+
+
+def save_ai_service_config(config: AIServiceConfig) -> None:
+    save_service_config("ai_service", config.model_dump())
+
+
+def load_ai_service_config_masked() -> dict:
+    raw = load_service_config("ai_service")
+    return _mask_ai_config(raw)
+
+
+# Doc service helpers
+
 def load_doc_service_config() -> DocServiceConfig:
     raw = load_service_config("doc_service")
     return DocServiceConfig.model_validate(raw)
@@ -108,8 +126,7 @@ def save_doc_service_config(config: DocServiceConfig) -> None:
 
 
 def load_doc_service_config_masked() -> dict:
-    raw = load_service_config("doc_service")
-    return _mask_config(raw)
+    return load_service_config("doc_service")
 
 
 def _merge_api_key(new_key: str, existing_key: str) -> str:

backend/app/core/config.py

@@ -15,6 +15,8 @@ class Settings(BaseSettings):
 
     CORS_ORIGINS: list[str] = ["http://localhost:5173"]
 
+    AI_SERVICE_URL: str = "http://ai-service:8010"
+
     @field_validator("JWT_PRIVATE_KEY", "JWT_PUBLIC_KEY", mode="before")
     @classmethod
     def expand_newlines(cls, v: str) -> str: