ops: sunset LiteLLM, add owui to Backrest, drop stale DB+role

- LiteLLM sunset 2026-05-28: container removed, config dir renamed
  .DECOMMISSIONED-2026-05-28, prometheus scrape job deleted, CT 113
  litellm DB + role dropped. Bifrost now connects directly to upstream
  LLM providers (verified: openai → SAIA chat-ai.academiccloud.de).
- Open WebUI data (CT 104 uploads + vector_db, 192K) now staged to
  UNAS /services/open-webui via openwebui-prestage.sh and included in
  Backrest services-backup-plan. Open WebUI chats/users live in CT 113
  Postgres owui DB (already in WAL-G).
- Miniflux confirmed DB-only — already covered by WAL-G.
- backrest.md and homelab-architecture.md updated; services-overview.md
  marks LiteLLM row strikethrough.

services/homelab-architecture.md

@@ -150,13 +150,11 @@ The MCP gateway bridges `ai-internal` + `shared_backend`.
 ## AI / Agent platform  (the core, `/opt/stacks/ai`)
 - **Bifrost** (`ai.nuclide.systems`, :14003) — unified LLM gateway + MCP host.
   Stack `ai/bifrost/`. Auth via `sk-bf-` VKs. LLM inference at `/v1`; MCP at
-  `/mcp` (29 clients, ~760 tools as of 2026-05-26). Proxies LLM requests to
-  LiteLLM internally.
-- **LiteLLM** (:14000, **internal only** — no Zoraxy route) — model gateway,
-  backend for Bifrost. ~28 curated models (provider allowlist), SAIA-terminal
-  **failovers** + `num_retries`, Redis completion cache, Gemini €10/30d
-  `provider_budget_config`. Config: `ai/litellm-config/config.yaml` (+ DB
-  overlay `LiteLLM_Config`). Reachable as `http://litellm:4000` inside Docker.
+  `/mcp` (29 clients, ~760 tools as of 2026-05-26). Connects directly to
+  upstream LLM providers; no LiteLLM hop in the chain anymore.
+- ~~**LiteLLM**~~ — **SUNSET 2026-05-28**. Container removed, DB + role dropped on CT 113,
+  config dir renamed `litellm-config.DECOMMISSIONED-2026-05-28`, Prometheus
+  scrape job deleted. Bifrost now handles all LLM gateway responsibilities.
 - **Open WebUI** (`chat.nuclide.systems`, :14002) — chat UI. Stack
   `ai/open-webui.yml`. Uses Qdrant + TEI for RAG. OIDC via Pocket-ID (not
   yet wired as of 2026-05-26).
@@ -184,7 +182,7 @@ The MCP gateway bridges `ai-internal` + `shared_backend`.
 
 ## Data layer
 - **shared-postgres** (pg16, `shared_backend`, data on local ZFS) — the
-  **primary/standard DB for all deployments**. Tenants: LiteLLM, paperless,
+  **primary/standard DB for all deployments**. Tenants: paperless,
   **memos** (migrated 2026-05-19), n8n (added 2026-05-19). Superuser
   `postgres` via unix socket; per-app dedicated role+db (role owns its db,
   password in the app stack's `.env`). Tuned 2026-05-19 (3G limit,
@@ -206,7 +204,7 @@ The MCP gateway bridges `ai-internal` + `shared_backend`.
   **pgloader data-only of ALL tables** into the app-built schema (exclude
   only the app's own migration-tracking table), app role temp-SUPERUSER for
   the load (FK/trigger disable) then reverted.
-- **lobe-postgres** (pg17/ParadeDB) — LobeChat (decommissioned 2026-05-26; DB retained pending cleanup). **lobe-redis** — LiteLLM cache (LobeChat decommissioned). **Garage S3** (`garage:3900`, ext `s3.nuclide.systems` /
+- **lobe-postgres** (pg17/ParadeDB) — LobeChat (decommissioned 2026-05-26; DB retained pending cleanup). ~~**lobe-redis**~~ — was LiteLLM cache; both LobeChat and LiteLLM decommissioned. **Garage S3** (`garage:3900`, ext `s3.nuclide.systems` /
   `:10004`) — lobe-files, memos, **WAL-G PG backups**. **Qdrant** (vector,
   on UNAS) — unused yet (future RAG/mem0). pgAdmin (internal).
 - **Backups**: WAL-G v3 → Garage for all 3 PG instances (shared-postgres,