Docker Compose stack and admin-managed model endpoints land together

The compose stack brings up frontend, backend, a Supabase-compatible auth/PostgREST/Postgres cluster, MinIO with bucket init, and a schema bootstrap container. A .env.docker.example file drives the whole thing. cp .env.docker.example .env.docker && docker compose --env-file .env.docker up --build is the complete install path.

The managedModels.ts module (289 lines) stores model endpoints in a new user_managed_models table. Encryption uses AES-256-GCM with a key derived from USER_API_KEYS_ENCRYPTION_SECRET, falling back to API_KEYS_ENCRYPTION_SECRET, then SUPABASE_SECRET_KEY. That last fallback couples key rotation to Supabase credentials, which is worth knowing before you rely on it. Two provider tags are defined: foundry and local_openai_compatible. A new openaiCompatible.ts adapter (231 lines) handles streaming and tool-call shapes for both. The routes/user.ts rewrite is 633 lines changed and touches non-model endpoints as well - splitting it for a cherry-pick will need care.

The hardening follow-up (PR #13) fixed a meaningful security issue: SUPABASE_SECRET_KEY was being passed as a frontend Dockerfile ARG and baked into the Next.js build context. That's a server-only credential that should never reach a client-side bundle. Removed from both the Dockerfile and compose runtime env. The same PR pinned minio/minio and minio/mc to specific dated releases instead of :latest (RELEASE.2025-09-07T16-13-09Z and RELEASE.2025-08-13T08-35-41Z respectively) and added extra_hosts: host.docker.internal:host-gateway so the backend can reach host-running model runtimes on Linux Docker (previously only Docker Desktop worked). Development JWTs in .env.docker.example were also regenerated to expire in 2040 rather than 2027.

632 lines of new tests cover the OpenAI adapter, config parsing, provider settings, and storage.