feat: MLOps external services, AI stack planning, admin MLOps hub

Infrastructure:
- Add `mlops` compose profile: MLflow (basic-auth, /mlflow path) + Airflow (LocalExecutor, /airflow path) + airflow-db
- infra/mlflow/basic_auth.ini for MLflow auth config
- Caddy routes /mlflow* and /airflow* inside existing o.alogins.net block (see agap_git)
- Dockerfile.admin: NEXT_PUBLIC_MLFLOW_URL / NEXT_PUBLIC_AIRFLOW_URL build args (default /mlflow, /airflow)

Admin panel:
- /admin/models: replace MLflow iframe with external link cards
- /admin/experiments: replace LinUCB stats with MLOps hub (links to MLflow experiments/models + Airflow DAGs/datasets)
- AdminShell: external nav links for MLflow ↗ and Airflow ↗ under MLOps section

Docs & planning:
- README: new AI stack section (Ollama/LiteLLM/OpenWebUI three-tier, tip generation pipeline, model aliases)
- README: Phase 2 expanded with AI infra issues (#86-#93) and granular pipeline breakdown
- README: Phase 4 expanded with LLM MLOps items (#94-#97)
- CLAUDE.md: AI stack section, updated current phase (M1 shipped / M2 in progress), compose profiles, updated What NOT to do
- docs/architecture/overview.md: AI stack section, updated decision flow diagram for Phase 2 LLM pipeline
- ADR-0006: updated to reflect external services (path-based, not embedded)
- Gitea issues #86-#97 created (M2: AI infra + pipeline; M4: LLM MLOps)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/api/src/index.ts

@@ -3,7 +3,9 @@ import express from 'express';
 import cookieParser from 'cookie-parser';
 import cors from 'cors';
 import { config } from './config.js';
-import { runMigrations } from './db/index.js';
+import { db, runMigrations } from './db/index.js';
+import { tipScores, tipFeedback } from './db/schema.js';
+import { lt } from 'drizzle-orm';
 import { sessionMiddleware } from './middleware/session.js';
 import { authRouter } from './routes/auth.js';
 import { integrationsRouter } from './routes/integrations.js';
@@ -20,6 +22,15 @@ import type { Request, Response } from 'express';
 await mkdir(dirname(config.DATABASE_PATH), { recursive: true });
 runMigrations();
 
+// Keep the API alive on stray async faults (e.g. a single bad admin route)
+// rather than dropping the whole process.
+process.on('unhandledRejection', (reason) => {
+  console.error('[api] unhandledRejection', reason);
+});
+process.on('uncaughtException', (err) => {
+  console.error('[api] uncaughtException', err);
+});
+
 const app = express();
 
 app.use(
@@ -61,6 +72,19 @@ app.use('/api/ml', requireAuth as any, requireAdmin as any, async (req: Request,
   }
 });
 
+async function purgeExpiredData() {
+  const cutoff = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString();
+  try {
+    await db.delete(tipScores).where(lt(tipScores.servedAt, cutoff));
+    await db.delete(tipFeedback).where(lt(tipFeedback.createdAt, cutoff));
+  } catch (err: any) {
+    console.error(`[purge] retention cleanup failed: ${err.message}`);
+  }
+}
+
+purgeExpiredData();
+setInterval(purgeExpiredData, 24 * 60 * 60 * 1000);
+
 app.listen(config.PORT, () => {
   console.log(`oO API listening on http://localhost:${config.PORT}`);
 });