[pull] main from Open-Legal-Products:main

Bring the whole app up with a single `docker compose up` and no external
accounts.

Self-contained stack:
- Embedded Supabase (Postgres + GoTrue auth + PostgREST + an nginx gateway),
  with the schema auto-loaded on first boot and auth emails auto-confirmable.
- RustFS for S3-compatible object storage, replacing Cloudflare R2.
- Mailpit catches auth emails (signup/confirmation) in a local inbox.
- Production-style image builds for the frontend and backend.

Local models via Ollama:
- New provider speaking Ollama's OpenAI-compatible chat API, including the
  agentic tool-call loop and a graceful fallback for models that don't
  support tools.
- Models are detected dynamically (GET /models/ollama) and appear in every
  model picker (chat, title, tabular review) under a "Local" group, with no
  API key required. Any `ollama/<tag>` id is valid by prefix.
- Manual "Refresh" button on the API Keys page re-detects installed models
  and re-checks key status, pushing updates live to the pickers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

env_file: ./backend/.env was a hard failure when the file is absent, which
is always the case on Dokploy and similar platforms that inject env vars
rather than committing a .env.

Both backend/.env and the compose-root .env are now optional sources, root
last so hosted values win. Secrets deliberately stay out of environment:,
which overrides env_file - a bare name unset on the host silently blanks
out the value the file supplied.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Fixed host ports assume a dev machine. On Dokploy, 3000 is the dashboard's,
so the frontend fails with 'port is already allocated'. Each published port
now takes an env override with the current value as default, so local dev is
unchanged.

Infra ports (postgres, mailpit, storage) now bind 127.0.0.1 instead of
0.0.0.0. They were reachable from the internet on a public host while still
carrying default credentials, and the mailpit inbox exposes password-reset
links. Compose service-to-service networking is unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

GoTrue's API_EXTERNAL_URL and SITE_URL were hardcoded to localhost, so
confirmation links pointed at the user's own machine and signup could never
be completed on a hosted deploy. Both now derive from the public URLs.

MAILER_AUTOCONFIRM and DISABLE_SIGNUP are configurable too: a host with no
real SMTP needs autoconfirm on to register at all, and open registration
should be closable once the operator has an account. Defaults unchanged, so
local dev still exercises the real email flow via Mailpit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Bare Ollama needs no auth, but OpenAI-compatible servers behind a gateway
(vLLM --api-key, Open WebUI, LiteLLM) require a bearer token. OLLAMA_API_KEY,
when set, is sent on both model discovery and chat completions; absent, the
provider behaves exactly as before.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The Supabase CLI auto-seeds supabase/roles.sql as globals during
'supabase start'. On the current supabase/postgres 17.x images that
seed connection is not a superuser, and supabase_auth_admin is a
reserved role, so ALTER ROLE fails with SQLSTATE 42501 and kills the
e2e job before Playwright runs.

The file only exists for the docker-compose stack, where it runs as
the init superuser via /docker-entrypoint-initdb.d. Move it to
docker/db-init/ and update the compose mount; CI's 'supabase start'
no longer sees it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>