litellm: add OpenAI→Meridian shim role (venv + systemd, port 4000)

LiteLLM sits in front of Meridian for clients that can't talk Anthropic's
/v1/messages format (Pulse OpenAI provider, paperless-ai, etc.). Routes
OpenAI-shaped requests to localhost:3456 (Meridian) which forwards to the
Max sub.

- New roles/litellm/ — Python venv, pip install litellm[proxy], systemd
- vars/main.yml — model map (haiku/sonnet/opus) + LITELLM_MASTER_KEY env lookup
- site.yml — adds litellm role + sanity-check assert
- deploy.sh — pulls LITELLM_MASTER_KEY from Infisical (/meridian/) on the
  controller and exports it for the playbook
- New Infisical secret /meridian/vault_litellm_master_key

Smoke: Pulse → LiteLLM /v1/chat/completions → Meridian /v1/messages → Max sub
returns "pong" through both the LiteLLM master key auth and the Claude Code
SDK OAuth.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

roles/litellm/templates/litellm-config.yaml.j2

@@ -0,0 +1,21 @@
+# {{ ansible_managed }}
+#
+# LiteLLM proxy config. Routes OpenAI-shaped requests to Meridian's
+# /v1/messages (Anthropic format). Meridian (same host, :3456) ignores the
+# upstream API key, so we pass a placeholder.
+
+model_list:
+{% for m in litellm_models %}
+  - model_name: {{ m.name }}
+    litellm_params:
+      model: {{ m.backend }}
+      api_base: http://127.0.0.1:{{ meridian_port }}
+      api_key: placeholder-meridian-ignores-this
+{% endfor %}
+
+general_settings:
+  master_key: os.environ/LITELLM_MASTER_KEY
+
+litellm_settings:
+  drop_params: true        # tolerate clients sending unsupported params
+  set_verbose: false

roles/litellm/templates/litellm.env.j2

@@ -0,0 +1,2 @@
+# {{ ansible_managed }}
+LITELLM_MASTER_KEY={{ litellm_master_key }}

roles/litellm/templates/litellm.service.j2

@@ -0,0 +1,21 @@
+[Unit]
+Description=LiteLLM (OpenAI → Meridian shim)
+Documentation=https://docs.litellm.ai/
+After=network-online.target meridian.service
+Wants=network-online.target
+Requires=meridian.service
+
+[Service]
+Type=simple
+User={{ litellm_user }}
+Group={{ litellm_user }}
+WorkingDirectory={{ litellm_home }}
+EnvironmentFile={{ litellm_home }}/litellm.env
+ExecStart={{ litellm_venv }}/bin/litellm --config {{ litellm_home }}/config.yaml --host {{ litellm_host }} --port {{ litellm_port }} --num_workers 1
+Restart=on-failure
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target