Route all chat through a local LiteLLM gateway, drop command prefixes

- New litellm service (pinned v1.98.0 — litellm 1.82.7/1.82.8 on PyPI were
  compromised with credential-stealing malware in March 2026; internal-only,
  no Traefik route, no reason to expose an LLM gateway with a master key
  publicly).
- Replaces !claude/!ai command prefixes with automatic routing: every plain
  message in the control room goes through a classifier (router.js) that
  decides chat vs code_task. Chat replies use OpenRouter's own auto-router
  (openrouter/auto) via LiteLLM; code_task requests go through the existing
  runChatTask() flow (Claude Code CLI, unchanged, still using the
  subscription token directly).
- Investigated routing Claude itself through LiteLLM via OAuth token
  forwarding (general_settings.forward_client_headers_to_llm_api) so the
  Pro/Max subscription could be one of the auto-routable options. Confirmed
  non-functional: Anthropic returns a generic rate_limit_error for any
  direct API call using this token type outside the real Claude Code CLI,
  reproduced with plain curl straight to api.anthropic.com. Not included.
- MATRIX_BOT_USER_ID now required and set explicitly (self-message filtering
  can no longer rely on a command-prefix mismatch once there isn't one).

.env.example

@@ -25,10 +25,20 @@ CLAUDE_CODE_OAUTH_TOKEN=
 MATRIX_HOMESERVER_URL=https://matrix.apps.williamturner.eu
 MATRIX_BOT_TOKEN=
 MATRIX_CONTROL_ROOM_ID=
+# The bot's own Matrix ID (@username:server), e.g. @claude-bot:matrix.apps.williamturner.eu
+# — set explicitly rather than fetched via the API (that call 404s against Continuwuity).
+# Required: without it the bot can't tell its own messages apart from real ones and would
+# reply to itself in a loop, so it refuses to start.
+MATRIX_BOT_USER_ID=
+# Comma-separated "owner/repo" list the chat router is allowed to open code-change PRs
+# against. A plain chat message mentioning a repo NOT in this list is treated as chat,
+# never as a code task — the router only matches confidently against known repos.
+KNOWN_REPOS=william/gitops-automation
 
-# --- openrouter (the "!ai" chat command — other models, not the coding agent) ---
+# --- litellm (local LLM gateway — see litellm-config.yaml) ---
 OPENROUTER_API_KEY=
-OPENROUTER_DEFAULT_MODEL=openai/gpt-4o-mini
+# Any random string; also used as litellm's general_settings.master_key.
+LITELLM_MASTER_KEY=
 
 # --- portainer (GitOps redeploy) ---
 PORTAINER_STACK_WEBHOOK_URL=