openai: compose healthchecks + dependency ordering, registries, LiteLLM routing

docker-compose.yml gains healthchecks and depends_on/condition chains for the
litellm/langfuse/postgres tier so dependants wait for a genuinely ready
service instead of a started container. Also plumbs AGAP_MCP_TOKEN into the
adolf and adolf-llm containers, sourced from openai/.env (gitignored), for the
kb#180 bearer auth on the agap MCP server; shared-mcp.json consumes it via
bearerTokenEnvVar so the Kimi backbone authenticates too.

agent-registry.yaml / agent_registry.py: the version-controlled source of
truth for agent identities and trust classes -- the same ids the agap-mcp
token map resolves to (`adolf`, `claude-coder`; note `claude-code-cli` is the
runtime entry, not an agent identity).

model-registry.yaml, litellm-config.yaml, auto-router-routes.json and
provision_litellm_keys.py: model tiering, virtual-key provisioning and
auto-router routes. tei-reranker/ is the local reranker service backing
Hindsight recall.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

openai/cognee-llm/README.md

@@ -1,5 +1,12 @@
 # cognee-llm (:8011)
 
+> ⚠️ **SUPERSEDED — Adolf's memory is migrating Cognee → Hindsight (2026-07-13).**
+> Hindsight runs its LLM on LiteLLM `:4000` / Ollama, so this bespoke Kimi-CLI
+> wrapper is being **retired**, not ported (SPIKE gate 5 already concluded the
+> extraction workload shouldn't sit on the Kimi seat). This service is decommissioned
+> in migration task **H4**. Plan: `agap_git/adolf/HINDSIGHT-MIGRATION.md`. The doc
+> below describes the outgoing Cognee stack, kept until H4 lands.
+
 OpenAI-compatible wrapper around the Kimi Code CLI (`@moonshot-ai/kimi-code`, home
 `/root/.kimi-code`), built for Cognee's batch/structured LLM calls. **Opposite policy to
 `kimi-agent`**: