Add a retrieval-only HTTP bridge so Open-WebUI can reach the index

Open-WebUI runs in its own container with no WebGUI session, and nginx applies
auth_request to everything it serves, so it cannot call the plugin API. Same
shape as the arr webhook listener: node outside nginx, shared secret, one
read-only verb. Serves chunks rather than answers because the caller already
has a model loaded.

Deployment/master.conf.template

@@ -302,6 +302,7 @@
         "Docker_Essentials/docker_network_connect.sh" # ensure networks exist + connect containers
         "Arrs_Stack/arr_cache_prefill.sh"               # warm Lidarr/Sonarr/Radarr tracked-data caches before anything reads them cold
         "Arrs_Stack/start_webhook_listener.sh"             # arr upgrade webhook listener — continuous
+        "AI/start_ai_server.sh"                       # retrieval bridge for Open-WebUI — continuous, self-disables if AI_ENABLED=false
         "Fallback/fallback.sh"                        # mutual failover — continuous
     )
 
@@ -1625,6 +1626,19 @@
     AI_SEARCH_K=8                   # chunks retrieved per query
     AI_SEARCH_PER_FILE=3            # cap per file so one document cannot fill the context
 
+# ━━━ AI Retrieval Bridge ━━━
+# AI/ai_serve.js — a retrieval-only HTTP endpoint for clients that cannot see this filesystem.
+# Open-WebUI runs in its own container with no WebGUI session, and nginx applies auth_request to
+# everything it serves, so a container cannot reach the plugin's PHP API. Same reasoning, and
+# same shape, as WEBHOOK_PORT / WEBHOOK_SECRET above.
+#
+# It serves chunks, never answers — the caller already has a model. Read-only over documentation
+# that is already in git; the secret is the only gate, so treat the port as public and keep the
+# surface at one verb. Port 0 disables it.
+    AI_HTTP_PORT=7822
+    AI_HTTP_SECRET=""               # auto-generated on first start if empty
+    AI_HTTP_BIND="0.0.0.0"          # must be reachable from the docker bridge, not just loopback
+
 # ━━━ AI Feature Toggles ━━━
 # Tier 1 is narration — it cannot change a decision. Tier 2 adds context to a decision a script
 # already made. Tier 3 assists a human. Enable in that order, and give each one weeks.