Initial portal commit: landing + 9 AI-powered apps

Apps:
- dwg-rooms: extract room numbers from DWG/DXF
- dwg-counting: count symbols in PDF drawings (OpenCV template matching)
- contract-check: review PDF contracts against a checklist (Claude vision + Tesseract OCR fallback)
- email-drafter: bullet notes → polished Czech/English business emails
- invoice-extractor: PDF/image invoice → structured data → Excel
- translator: Czech-first translator across 19 languages with tone control
- vv-check: find inconsistent unit prices across VV sheets in one workbook
- vv-compare: diff original vs new VV files (changes / added / removed)
- feature-request: portal users submit ideas + sample files

Infrastructure:
- LiteLLM gateway with per-app virtual keys + budgets
- Langfuse observability
- Geist font, shared theme, cross-subdomain back link + theme sync via cookie/URL
- Caddy reverse proxy on *.klas.chat

docker-compose.yml

@@ -0,0 +1,60 @@
+services:
+  landing:
+    build:
+      context: ./landing
+      dockerfile: Dockerfile
+    container_name: ai-portal-landing
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:3010:3010"
+      - "100.95.104.123:3010:3010"  # Tailscale (t6)
+    environment:
+      AUTH_SECRET: ${AUTH_SECRET:?set AUTH_SECRET in .env}
+      AUTH_TRUST_HOST: "true"
+      NEXTAUTH_URL: ${NEXTAUTH_URL:-https://ai.klas.chat}
+      DEV_PORTAL_PASSWORD: ${DEV_PORTAL_PASSWORD:-}
+      AUTH_MICROSOFT_ENTRA_ID_ID: ${AUTH_MICROSOFT_ENTRA_ID_ID:-}
+      AUTH_MICROSOFT_ENTRA_ID_SECRET: ${AUTH_MICROSOFT_ENTRA_ID_SECRET:-}
+      AUTH_MICROSOFT_ENTRA_ID_ISSUER: ${AUTH_MICROSOFT_ENTRA_ID_ISSUER:-}
+    networks:
+      - localai
+
+  # Langfuse observability stack (optional for v1 — uncomment when ready).
+  # Reference: https://langfuse.com/self-hosting/docker-compose
+  #
+  # langfuse-db:
+  #   image: postgres:16
+  #   container_name: ai-portal-langfuse-db
+  #   restart: unless-stopped
+  #   environment:
+  #     POSTGRES_USER: langfuse
+  #     POSTGRES_PASSWORD: ${LANGFUSE_DB_PASSWORD}
+  #     POSTGRES_DB: langfuse
+  #   volumes:
+  #     - langfuse-db:/var/lib/postgresql/data
+  #   networks:
+  #     - localai
+  #
+  # langfuse:
+  #   image: langfuse/langfuse:2
+  #   container_name: ai-portal-langfuse
+  #   restart: unless-stopped
+  #   depends_on:
+  #     - langfuse-db
+  #   ports:
+  #     - "127.0.0.1:3011:3000"
+  #   environment:
+  #     DATABASE_URL: postgresql://langfuse:${LANGFUSE_DB_PASSWORD}@langfuse-db:5432/langfuse
+  #     NEXTAUTH_URL: https://langfuse.klas.chat
+  #     NEXTAUTH_SECRET: ${LANGFUSE_NEXTAUTH_SECRET}
+  #     SALT: ${LANGFUSE_SALT}
+  #     TELEMETRY_ENABLED: "false"
+  #   networks:
+  #     - localai
+
+# volumes:
+#   langfuse-db:
+
+networks:
+  localai:
+    external: true