Add Caddy LLM proxy and API key enforcement

[NoorChasib]

Introduce a path-based Caddy reverse proxy for the LLM server: add a Caddyfile with model routes and a models.json manifest, plus a llm_proxy service in the controller compose file (exposes 80/443, adds caddy volumes). Require and document LLM_API_KEY and LLM_DOMAIN in the .env template. Enforce API auth in the llm container entrypoint (fail startup if LLM_API_KEY unset) and pass the key to model processes via --api-key. Minor models.conf comment update to reflect GLM 4.1V 9B.

🎯 Summary

ZUBA-

🔰 Checklist

• I have read and agree with the following checklist

• I have performed a self-review of my code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation where required.
• I have tested my changes to the best of my ability.
• I have consulted with the team if introducing a new dependency.

[dbarkowsky]

This all seems straightforward.
Would appreciate a little walkthrough sometime in the next few weeks though to fully see how it's used in practice with hosted models.

[Bottle7]

🚀