feat(stack): create unified agents stack with Tatlock and Webber

Consolidate Tatlock API into new agents stack and add Webber LLM agent
orchestration service. Webber provides autonomous agent execution with
tool use, authenticating via Tatlock API.

Changes:
- Add stacks/agents.yml with Tatlock (port 8000) and Webber (port 8086)
- Remove stacks/tatlock.yml (merged into agents stack)
- Document Webber service in CONTAINERS.md (Redis DB 9)
- Add full Tatlock API documentation to CONTAINERS.md

Config updates (pre-existing):
- core-api: Enable OIDC, add host stats access, simplify model config
- gitea: Migrate from dedicated DB to postgres-shared
- media: Remove GPU reservation from Jellyfin

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

stacks/agents.yml

@@ -0,0 +1,147 @@
+version: '3.8'
+
+# Agents Stack - LLM Agent Services
+# Purpose: AI agent orchestration APIs (Tatlock + Webber)
+# Ports: 8000 (Tatlock), 8086 (Webber)
+# Network: docker-dataplane
+# Images: git.schweitz.internal/jpmschweitzer/tatlock, git.schweitz.internal/jpmschweitzer/webber
+
+services:
+  # ============================================
+  # Tatlock - The Homelab Butler
+  # OpenAI-compatible API with LLM agent orchestration
+  # Port: 8000
+  # ============================================
+  tatlock:
+    image: git.schweitz.internal/jpmschweitzer/tatlock:latest
+    container_name: tatlock
+    restart: unless-stopped
+
+    ports:
+      - "8000:8000"
+
+    environment:
+      - ENVIRONMENT=production
+      - API_HOST=0.0.0.0
+      - API_PORT=8000
+      # Ollama (shared service)
+      - OLLAMA_HOST=http://ollama:11434
+      - OLLAMA_DEFAULT_MODEL=mistral-nemo:latest
+      - OLLAMA_TIMEOUT=120
+      # SearXNG (optional, shared service)
+      - SEARXNG_HOST=http://searxng:8080
+      - SEARXNG_TIMEOUT=30
+      # Qdrant (vector database)
+      - QDRANT_HOST=qdrant
+      - QDRANT_PORT=6333
+      # Redis (shared service)
+      - REDIS_HOST=redis-shared
+      - REDIS_PORT=6379
+      - REDIS_MEMORY_DB=1
+      - REDIS_BENCHMARK_DB=6
+      - REDIS_TIMEOUT=5
+      # Features
+      - ENABLE_BENCHMARKS=true
+      - CORS_ORIGINS=["*"]
+      - PYTHONPATH=/app
+      # Library Desk API
+      - LIBRARY_DESK_HOST=http://library-desk:8089
+      - LIBRARY_DESK_API_KEY=${LIBRARY_API_KEY}
+
+    volumes:
+      - /home/jpmschweitzer/docker-data/tatlock/logs:/app/logs
+
+    networks:
+      - docker-dataplane
+
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 1G
+        reservations:
+          memory: 256M
+
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+  # ============================================
+  # Webber - LLM Agent Orchestration API
+  # Autonomous agent execution with tool use
+  # Port: 8086
+  # ============================================
+  webber:
+    image: git.schweitz.internal/jpmschweitzer/webber:latest
+    container_name: webber
+    restart: unless-stopped
+
+    ports:
+      - "8086:8086"
+
+    environment:
+      # App settings
+      - DEBUG=false
+      - LOG_LEVEL=INFO
+      - PYTHONPATH=/app
+      # Server config
+      - HOST=0.0.0.0
+      - PORT=8086
+      # CORS
+      - CORS_ORIGINS=["*"]
+      - CORS_METHODS=["*"]
+      - CORS_HEADERS=["*"]
+      # Ollama (shared service) - LLM Models hot in VRAM
+      - OLLAMA_URL=http://ollama:11434
+      - OLLAMA_AGENT_MODEL=mistral-nemo:latest
+      - OLLAMA_EMBED_MODEL=nomic-embed-text:latest
+      # Auth - Tatlock API for user validation
+      - TATLOCK_API_URL=http://tatlock:8000
+      - TATLOCK_API_KEY=${WEBBER_TATLOCK_API_KEY}
+      # Tool execution settings
+      - TOOL_TIMEOUT_SECONDS=30
+      - SANDBOX_ENABLED=true
+      - ALLOWED_PATHS=/app/sandbox,/tmp
+      # Session management
+      - SESSION_TTL_HOURS=24
+      - MAX_CONTEXT_TOKENS=8192
+      # Redis (shared service)
+      - REDIS_HOST=redis-shared
+      - REDIS_PORT=6379
+      - REDIS_DB=9
+
+    volumes:
+      - /home/jpmschweitzer/docker-data/webber/logs:/app/logs
+      - /home/jpmschweitzer/docker-data/webber/sandbox:/app/sandbox
+
+    networks:
+      - docker-dataplane
+
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 1G
+        reservations:
+          memory: 256M
+
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8086/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+networks:
+  docker-dataplane:
+    external: true
+    name: docker-dataplane