Add shared ai-service container as AI provider intermediary

All feature containers now POST messages to ai-service (port 8010) instead
of calling AI providers directly. ai-service routes to LM Studio, Ollama,
or Anthropic based on /config/ai_service_config.json. doc-service AI
providers removed; replaced by httpx ai_client.py. Backend settings
restructured to /api/settings/ai. Frontend gets dedicated AIAdminSettingsPage
and AI Service card in AppsPage.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -31,6 +31,7 @@ services:
     environment:
       DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-password}@db:5432/${POSTGRES_DB:-destroying_sap}
       DOC_SERVICE_URL: http://doc-service:8001
+      AI_SERVICE_URL: http://ai-service:8010
     volumes:
       - app_config:/config
     depends_on:
@@ -39,6 +40,21 @@ services:
     networks:
       - backend-net
 
+  # ── AI service (shared AI provider intermediary) ─────────────────────────────
+  ai-service:
+    build:
+      context: ./features/ai-service
+      dockerfile: Dockerfile
+      network: host
+    user: "1001:1001"
+    restart: unless-stopped
+    environment:
+      CONFIG_PATH: /config/ai_service_config.json
+    volumes:
+      - app_config:/config
+    networks:
+      - backend-net
+
   # ── Doc service (PDF extraction) ────────────────────────────────────────────
   doc-service:
     build:
@@ -51,12 +67,15 @@ services:
       DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-password}@db:5432/${POSTGRES_DB:-destroying_sap}
       DATA_DIR: /data/documents
       CONFIG_PATH: /config/doc_service_config.json
+      AI_SERVICE_URL: http://ai-service:8010
     volumes:
       - doc_data:/data/documents
       - app_config:/config
     depends_on:
       db:
         condition: service_healthy
+      ai-service:
+        condition: service_started
     networks:
       - backend-net