litellm: add OpenAI→Meridian shim role (venv + systemd, port 4000)

LiteLLM sits in front of Meridian for clients that can't talk Anthropic's
/v1/messages format (Pulse OpenAI provider, paperless-ai, etc.). Routes
OpenAI-shaped requests to localhost:3456 (Meridian) which forwards to the
Max sub.

- New roles/litellm/ — Python venv, pip install litellm[proxy], systemd
- vars/main.yml — model map (haiku/sonnet/opus) + LITELLM_MASTER_KEY env lookup
- site.yml — adds litellm role + sanity-check assert
- deploy.sh — pulls LITELLM_MASTER_KEY from Infisical (/meridian/) on the
  controller and exports it for the playbook
- New Infisical secret /meridian/vault_litellm_master_key

Smoke: Pulse → LiteLLM /v1/chat/completions → Meridian /v1/messages → Max sub
returns "pong" through both the LiteLLM master key auth and the Claude Code
SDK OAuth.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

vars/main.yml

@@ -13,6 +13,7 @@ packages:
   - openssh-server
   - python3
   - python3-pip
+  - python3-venv
   - sudo
   - vim
   - wget
@@ -33,3 +34,25 @@ meridian_port: 3456
 meridian_host: "0.0.0.0"
 meridian_idle_timeout_seconds: 300
 meridian_node_major: 22
+
+# LiteLLM — OpenAI-compatible proxy in front of Meridian
+litellm_user: litellm
+litellm_home: /opt/litellm
+litellm_venv: /opt/litellm/venv
+litellm_port: 4000
+litellm_host: "0.0.0.0"
+litellm_package_spec: "litellm[proxy]==1.55.10"
+# Models map onto Meridian's pinned Anthropic-shape backend on 127.0.0.1:3456.
+# Add Sonnet/Opus aliases too so clients can pick cost vs quality without
+# touching this config.
+litellm_models:
+  - name: claude-haiku-4-5
+    backend: anthropic/claude-haiku-4-5
+  - name: claude-sonnet-4-6
+    backend: anthropic/claude-sonnet-4-6
+  - name: claude-opus-4-7
+    backend: anthropic/claude-opus-4-7
+# Master key is required by LiteLLM. Pulled at deploy time from Infisical
+# /meridian/vault_litellm_master_key and passed via -e on the playbook
+# (see deploy.sh).
+litellm_master_key: "{{ lookup('env', 'LITELLM_MASTER_KEY') | default('CHANGE_ME', true) }}"