Fix #215: pluggable LLM + embedding provider abstraction

Adds the vendor-agnostic seam the AI assistant + match-ranking plug into:
- LLMProvider / EmbeddingProvider ABCs (base.py). LLM and embeddings are
  SEPARATE abstractions — Anthropic has no embeddings endpoint, so each is
  configured independently and either can be off.
- NullLLMProvider / NullEmbeddingProvider — the default; fail loud with a clear
  "not configured" error so AI-off deployments don't silently no-op.
- AnthropicLLMProvider — first concrete LLM impl, via the official anthropic SDK
  (default model claude-opus-4-8). A local provider (e.g. Ollama) would be
  another subclass of the same interface.
- Factory in deps.py (get_llm_provider / get_embedding_provider) selects by
  env (MODEL_PROVIDER / EMBEDDING_PROVIDER); documented in .env.example.

Providers are read-only text/vector producers — they never touch the DB, so the
"AI never writes autonomously" invariant (CLAUDE.md #1) holds; writes will go
through ChangeProposal (#214).

Tests: provider selection (null default, anthropic when keyed, fallback without
key) + null providers raise. 81 passed.

Closes #215

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

deploy/.env.example

@@ -57,6 +57,15 @@ SMTP_USERNAME=
 SMTP_PASSWORD=
 SMTP_FROM=
 
+# --- Model providers (AI assistant + embeddings; both optional, default off) ---
+# LLM: 'null' disables AI features; 'anthropic' uses the Claude API.
+MODEL_PROVIDER=null
+ANTHROPIC_API_KEY=
+LLM_MODEL=claude-opus-4-8
+LLM_MAX_TOKENS=4096
+# Embeddings are separate (Anthropic has no embeddings endpoint). 'null' for now.
+EMBEDDING_PROVIDER=null
+
 # --- Model providers — wired in Phase 4 (AI assistant). BYO key. ---
 # ANTHROPIC_API_KEY=
 # OPENAI_API_KEY=