fix: ped-ai leaves Open WebUI's network, and pins LiteLLM internally on purpose

ped-ai joined open-webui_openwebui-network to resolve exactly one hostname:
libretranslate. LibreTranslate is its own Compose project but had no network of
its own, so it borrowed Open WebUI's — which meant a clinical app's startup was
coupled to an unrelated stack's lifecycle for a translation call.

LibreTranslate now owns danvics_translate and ped-ai joins that instead. It also
keeps its Open WebUI attachment, because Open WebUI is configured to use it
(webui.db refers to it) and cutting that would have broken translation there
silently. Verified after the move that Open WebUI still reaches it.

LITELLM_API_BASE is pinned to the container network again, now deliberately and
with the reason recorded: clinical traffic should not leave the host or depend on
Caddy, public DNS and edge TLS. Speed is not the reason — it is ~19ms on calls
taking hundreds of ms, and quoting that as "4x" was misleading. OpenBao still
stores the public URL for this key and Compose wins, so the vault value is dead
until someone changes it by hand; the app's AppRole is read-only by design.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU

docker-compose.yml

@@ -17,10 +17,17 @@ services:
       CLINICAL_ASSISTANT_MCP_URL: http://mcp:8000/mcp
       REDIS_URL: redis://ped-ai-redis:6379
       LOKI_URL: http://monitoring-loki:3100
-      # LITELLM_API_BASE is deliberately NOT set here. Compose env wins over
-      # OpenBao, so hardcoding the internal URL silently overrode the vault's
-      # https://llm.danvics.com and the intended config never took effect.
-      # Set it here only to pin ped-ai to the internal gateway on purpose.
+      # Deliberate: ped-ai talks to LiteLLM over the container network, not the
+      # public hostname. Clinical traffic then never leaves the host and does
+      # not depend on Caddy, public DNS or edge TLS being up. The latency
+      # difference is ~19ms on calls that take hundreds of ms, so speed is not
+      # the reason — not leaving the box is.
+      #
+      # OpenBao still stores https://llm.danvics.com for this key and Compose
+      # env wins, so the vault value is dead. Change it in the vault to match,
+      # or this line will keep looking like the accidental override it used to
+      # be. The app's AppRole is read-only, so that has to be done by hand.
+      LITELLM_API_BASE: http://litellm:4000
       TTS_PROVIDER: litellm
       LITELLM_TTS_MODEL: local-kokoro-tts
       LITELLM_TTS_VOICE: sherpa/kokoro:am_adam
@@ -58,7 +65,7 @@ services:
       - danvics_mcp
       - danvics_monitoring
       - ped-ai-storage-assets
-      - openwebui_openwebui
+      - danvics_translate
     healthcheck:
       test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health"]
       interval: 30s
@@ -119,6 +126,8 @@ networks:
   ped-ai-storage-assets:
     external: true
     name: personal-assistant-storage-milvus_assets
-  openwebui_openwebui:
+  # LibreTranslate's own service network, owned by the libretranslate project.
+  # ped-ai used to join open-webui's stack network purely to resolve this one
+  # hostname, which coupled a clinical app to an unrelated stack's lifecycle.
+  danvics_translate:
     external: true
-    name: open-webui_openwebui-network